Play interactive tour

Edit tour

Analysis Report yVn2ywuhEC.exe

Overview

General Information

Sample Name:	yVn2ywuhEC.exe
Analysis ID:	346304
MD5:	fa9649ba7f76190701b2f1ffaaf4d0df
SHA1:	dac66a285e89ee98cb84488df21f8c43c4acb5d3
SHA256:	772c627fc0b70e0454ff2e5464b9ee713a44a35298deba43f420e4fd21a0aeae
Tags:	ransomwareVovalex
Most interesting Screenshot:

Detection

VovaLex

Score:	40
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected VovaLex Ransomware

Connects to a URL shortener service

Modifies the hosts file

Modifies the windows firewall

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Uses netsh to modify the Windows network and firewall settings

Writes many files with high entropy

Abnormal high CPU Usage

Antivirus or Machine Learning detection for unpacked file

Connects to many different domains

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file contains strange resources

PE file does not import any functions

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Netsh Port or Application Allowed

Stores files to the Windows start menu directory

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

yVn2ywuhEC.exe (PID: 2168 cmdline: 'C:\Users\user\Desktop\yVn2ywuhEC.exe' -install MD5: FA9649BA7F76190701B2F1FFAAF4D0DF)

3yYh0IvfZPkSsqrl.exe (PID: 6128 cmdline: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe MD5: 70ED5E8A31519EC2FD1131020FE8421B)

3yYh0IvfZPkSsqrl.tmp (PID: 3008 cmdline: 'C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp' /SL5='$B0076,31402076,326656,C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe' MD5: 3A7636D874B391801839C0BEE90BED21)

netsh.exe (PID: 3292 cmdline: 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 3820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 5132 cmdline: 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 5204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 5700 cmdline: 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent (TCP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 5572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 5056 cmdline: 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent (UDP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 5956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

uTorrent.exe (PID: 5932 cmdline: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe MD5: 4939D280485BDC0AC67B49012BDCEC08)

yVn2ywuhEC.exe (PID: 5340 cmdline: 'C:\Users\user\Desktop\yVn2ywuhEC.exe' /install MD5: FA9649BA7F76190701B2F1FFAAF4D0DF)

0i1CtyGdkmLhJnVs.exe (PID: 5452 cmdline: C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe MD5: 70ED5E8A31519EC2FD1131020FE8421B)

0i1CtyGdkmLhJnVs.tmp (PID: 2160 cmdline: 'C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp' /SL5='$60238,31402076,326656,C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe' MD5: 3A7636D874B391801839C0BEE90BED21)

netsh.exe (PID: 5088 cmdline: 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 5580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 4080 cmdline: 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 1260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 5708 cmdline: 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent (TCP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 5984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 4916 cmdline: 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent (UDP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 5772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

yVn2ywuhEC.exe (PID: 996 cmdline: 'C:\Users\user\Desktop\yVn2ywuhEC.exe' /load MD5: FA9649BA7F76190701B2F1FFAAF4D0DF)

PHO27fVEZKCoh9MD.exe (PID: 4724 cmdline: C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe MD5: 70ED5E8A31519EC2FD1131020FE8421B)

PHO27fVEZKCoh9MD.tmp (PID: 4784 cmdline: 'C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp' /SL5='$303F2,31402076,326656,C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe' MD5: 3A7636D874B391801839C0BEE90BED21)

unins000.exe (PID: 5236 cmdline: C:\Users\user\AppData\Roaming\uTorrent\unins000.exe MD5: D2E364571A8BC684C4B11FD499CD023D)

_iu14D2N.tmp (PID: 1948 cmdline: 'C:\Users\user\AppData\Local\Temp\_iu14D2N.tmp' /SECONDPHASE='C:\Users\user\AppData\Roaming\uTorrent\unins000.exe' /FIRSTPHASEWND=$1700C2 MD5: D2E364571A8BC684C4B11FD499CD023D)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
yVn2ywuhEC.exe	JoeSecurity_vovalex	Yara detected VovaLex Ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000008.00000000.304380149.0000000140087000.00000008.00020000.sdmp	JoeSecurity_vovalex	Yara detected VovaLex Ransomware	Joe Security
00000000.00000000.239895376.0000000140087000.00000008.00020000.sdmp	JoeSecurity_vovalex	Yara detected VovaLex Ransomware	Joe Security
00000002.00000000.269817660.0000000140087000.00000008.00020000.sdmp	JoeSecurity_vovalex	Yara detected VovaLex Ransomware	Joe Security
Process Memory Space: yVn2ywuhEC.exe PID: 5340	JoeSecurity_vovalex	Yara detected VovaLex Ransomware	Joe Security
Process Memory Space: yVn2ywuhEC.exe PID: 2168	JoeSecurity_vovalex	Yara detected VovaLex Ransomware	Joe Security

Sigma Overview

System Summary:

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public, CommandLine: 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public, CommandLine|base64offset|contains: ijY, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: 'C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp' /SL5='$B0076,31402076,326656,C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe' , ParentImage: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp, ParentProcessId: 3008, ProcessCommandLine: 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public, ProcessId: 3292

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: yVn2ywuhEC.exe	Virustotal: Detection: 47%	Perma Link
Source: yVn2ywuhEC.exe	Metadefender: Detection: 13%	Perma Link
Source: yVn2ywuhEC.exe	ReversingLabs: Detection: 39%

Source: 29.0.uTorrent.exe.400000.0.unpack

Avira: Label: TR/Crypt.ULPM.Gen

Bitcoin Miner:

Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION utorrentie.exe

Jump to behavior

Compliance:

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown	HTTPS traffic detected: 54.197.251.114:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.197.251.114:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.79.242.16:443 -> 192.168.2.3:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.154.93:443 -> 192.168.2.3:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.154.93:443 -> 192.168.2.3:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.228.74.189:443 -> 192.168.2.3:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.228.74.189:443 -> 192.168.2.3:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.79.242.16:443 -> 192.168.2.3:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.128:443 -> 192.168.2.3:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.128:443 -> 192.168.2.3:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.128:443 -> 192.168.2.3:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.155:443 -> 192.168.2.3:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.155:443 -> 192.168.2.3:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.14:443 -> 192.168.2.3:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.14:443 -> 192.168.2.3:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.214.78.220:443 -> 192.168.2.3:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.214.78.220:443 -> 192.168.2.3:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.12.157:443 -> 192.168.2.3:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.12.157:443 -> 192.168.2.3:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.14:443 -> 192.168.2.3:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.14:443 -> 192.168.2.3:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.131:443 -> 192.168.2.3:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.131:443 -> 192.168.2.3:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.208.194.17:443 -> 192.168.2.3:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.69:443 -> 192.168.2.3:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.69:443 -> 192.168.2.3:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.154.93:443 -> 192.168.2.3:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.236.79:443 -> 192.168.2.3:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.154.93:443 -> 192.168.2.3:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.86.137.113:443 -> 192.168.2.3:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.197.251.114:443 -> 192.168.2.3:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.79.242.16:443 -> 192.168.2.3:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.79.242.16:443 -> 192.168.2.3:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.197.251.114:443 -> 192.168.2.3:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.197.251.114:443 -> 192.168.2.3:49835 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: yVn2ywuhEC.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Binary contains paths to debug symbols

Show sources

Source:	Binary string: d:\Projects\WinRAR\SFX\build\sfxzip32\Release\sfxzip.pdb source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp
Source:	Binary string: X:\jenkins-workspace\workspace\token-wallet-pipeline\build\MinSizeRel\helper.pdb source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.455095967.000000000665E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.483016018.0000000007E2E000.00000004.00000001.sdmp

Spreading:

Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_00405BEC GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	1_2_00405BEC
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004AD600 FindFirstFileW,GetLastError,	5_2_004AD600
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00408174 GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	5_2_00408174
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004FFC74 FindFirstFileW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,	5_2_004FFC74

Networking:

Connects to a URL shortener service

Show sources

Source: unknown

DNS query: name: t.co

Source: unknown

Network traffic detected: DNS query count 48

Source: unknown

Network traffic detected: IP country count 35

Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 82.221.103.244:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 67.215.246.10:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 189.250.0.174:1045
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 92.249.157.115:26816
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 69.119.127.215:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 161.230.30.190:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 180.245.10.11:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 89.240.209.7:16831
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 59.97.170.49:8000
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 206.188.117.12:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 27.57.254.186:62443
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 121.237.191.0:5366
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 91.103.78.235:56425
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 113.69.119.93:51413
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 173.172.64.220:50321
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 79.44.24.80:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 77.70.30.189:8999
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 81.183.59.95:17494
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 217.65.108.62:37033
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 94.36.132.239:51413
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 193.77.69.5:17572
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 87.92.146.184:24284
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 95.87.199.169:17642
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 86.92.71.126:19423
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 67.167.124.173:56507
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 89.64.54.152:12405
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 98.115.85.132:51413
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 47.55.190.78:52379
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 37.79.91.224:39349
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 185.14.28.165:55090
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 52.8.36.62:6911
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 3.211.230.23:6926
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 5.9.67.240:1910
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 119.8.127.135:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 49.34.70.36:63972
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 219.79.117.83:18994
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 121.45.79.34:49093
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 176.63.24.100:49269
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 208.110.106.75:54313
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 118.14.200.58:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 178.140.10.27:19559
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 213.136.79.7:11916
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 79.140.26.93:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 1.164.146.117:22338
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 134.249.127.48:34277
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 185.165.160.176:13329
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 126.142.30.153:51413
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 54.39.2.195:62898
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 149.255.29.135:49001
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 198.12.121.229:51413
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 112.168.71.78:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 88.90.139.39:22425
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 62.205.202.181:29690
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 183.167.31.157:5691
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 212.32.243.15:60160
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 94.251.128.6:1033
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 2.135.114.157:38811
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 176.65.116.74:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 195.38.11.55:8621
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 102.142.65.153:29101
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 94.190.193.153:50155
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 42.111.6.220:62544
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 80.251.153.186:49001
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 208.96.115.15:50321
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 2.61.72.86:50808
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 84.17.52.74:45381
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 18.218.241.3:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 92.240.51.15:25313
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 13.58.27.33:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 18.223.137.220:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 161.97.90.50:6882
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 110.87.72.111:18086
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 188.242.61.133:40343
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 84.107.14.129:6889
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 78.182.153.125:35027
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 54.194.137.170:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 210.6.117.216:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 38.121.71.145:6881
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 47.92.124.237:42260
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 188.163.58.192:23951
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 188.138.137.196:1152
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 212.46.18.149:3276
Source: global traffic	UDP traffic: 192.168.2.3:17720 -> 176.63.21.208:31987

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKx-amz-id-2: HyilXiFtOXAsln92CQqL/dAHcjYSH+NZKKPeIo4bscF/0otjHq+htbtggk5O8KuHu3fE4RhlOKA=x-amz-request-id: CB480E447BBB2D30Content-Type: binary/octet-streamServer: AmazonS3X-LLID: 3b3ebb0bab65070eb1152e6fc546d602Age: 24201Date: Sat, 30 Jan 2021 11:51:07 GMTLast-Modified: Wed, 13 Jan 2021 22:50:48 GMTContent-Length: 4901304Connection: closeData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 d0 9d 9a 67 b1 f3 c9 67 b1 f3 c9 67 b1 f3 c9 6e c9 60 c9 72 b1 f3 c9 67 b1 f2 c9 c1 b1 f3 c9 79 e3 66 c9 61 b1 f3 c9 6e c9 70 c9 6e b1 f3 c9 6e c9 77 c9 42 b1 f3 c9 6e c9 61 c9 66 b1 f3 c9 6e c9 67 c9 66 b1 f3 c9 6e c9 62 c9 66 b1 f3 c9 52 69 63 68 67 b1 f3 c9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 16 1d e1 4d 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ce 00 00 00 3a 02 00 00 00 00 00 fd 9a 00 00 00 10 00 00 00 e0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 40 03 00 00 04 00 00 1a ab 4b 00 02 00 00 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 fa 00 00 33 00 00 00 d4 ec 00 00 c8 00 00 00 00 f0 02 00 78 40 00 00 00 00 00 00 00 00 00 00 d8 8e 4a 00 e0 3a 00 00 00 00 00 00 00 00 00 00 90 e2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 90 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 4b cc 00 00 00 10 00 00 00 ce 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 75 1b 00 00 00 e0 00 00 00 1c 00 00 00 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d8 d9 01 00 00 00 01 00 00 02 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 10 00 00 00 00 e0 02 00 00 02 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 40 00 00 00 f0 02 00 00 42 00 00 00 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 82.221.103.244 82.221.103.244
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /network/index.html?adt=4&browser=ie&clientdata=ut%7c3%2e5%2e5%2e45852%7c290&geo=us&id=&ie=11&site=33049&uid=gGnNQ4MmOM9LtEpU&usermuted=0&w=1122893834&langs=en HTTP/1.1Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: cdn.bitmedianetwork.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /network/assets/css/styles.css HTTP/1.1Accept: /Referer: http://cdn.bitmedianetwork.com/network/index.html?adt=4&browser=ie&clientdata=ut%7c3.5.5.45852%7c290&geo=us&id=&ie=11&site=33049&uid=gGnNQ4MmOM9LtEpU&usermuted=0&w=1122893834&langs=enAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: cdn.bitmedianetwork.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /adzerk/ados-bt.js HTTP/1.1Accept: /Referer: http://cdn.bitmedianetwork.com/network/index.html?adt=4&browser=ie&clientdata=ut%7c3.5.5.45852%7c290&geo=us&id=&ie=11&site=33049&uid=gGnNQ4MmOM9LtEpU&usermuted=0&w=1122893834&langs=enAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: cdn.bitmedianetwork.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /assets/js/index-bundled.js HTTP/1.1Accept: /Referer: http://cdn.bitmedianetwork.com/network/index.html?adt=4&browser=ie&clientdata=ut%7c3.5.5.45852%7c290&geo=us&id=&ie=11&site=33049&uid=gGnNQ4MmOM9LtEpU&usermuted=0&w=1122893834&langs=enAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: cdn.bitmedianetwork.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /prodnews?v=3%2e5%2e5%2e1%2e45852 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: utorrent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /prodnews?v=3%2e5%2e5%2e1%2e45852 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.utorrent.com
Source: global traffic	HTTP traffic detected: GET /partners/didomi/client-cmp-ut.min.html?langs=en HTTP/1.1Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: video.trontv.comConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.142.210
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.142.210
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.142.210
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.142.210
Source: unknown	TCP traffic detected without corresponding DNS query: 84.53.167.113
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.179.193
Source: unknown	TCP traffic detected without corresponding DNS query: 84.53.167.113
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.179.193
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.179.193
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200

Source: global traffic	HTTP traffic detected: GET /utorrent-onboarding/player.btapp HTTP/1.1Host: apps.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/feature/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipConnection: Close
Source: global traffic	HTTP traffic detected: GET /network/index.html?adt=4&browser=ie&clientdata=ut%7c3%2e5%2e5%2e45852%7c290&geo=us&id=&ie=11&site=33049&uid=gGnNQ4MmOM9LtEpU&usermuted=0&w=1122893834&langs=en HTTP/1.1Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: cdn.bitmedianetwork.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /network/assets/css/styles.css HTTP/1.1Accept: /Referer: http://cdn.bitmedianetwork.com/network/index.html?adt=4&browser=ie&clientdata=ut%7c3.5.5.45852%7c290&geo=us&id=&ie=11&site=33049&uid=gGnNQ4MmOM9LtEpU&usermuted=0&w=1122893834&langs=enAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: cdn.bitmedianetwork.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /adzerk/ados-bt.js HTTP/1.1Accept: /Referer: http://cdn.bitmedianetwork.com/network/index.html?adt=4&browser=ie&clientdata=ut%7c3.5.5.45852%7c290&geo=us&id=&ie=11&site=33049&uid=gGnNQ4MmOM9LtEpU&usermuted=0&w=1122893834&langs=enAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: cdn.bitmedianetwork.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /assets/js/index-bundled.js HTTP/1.1Accept: /Referer: http://cdn.bitmedianetwork.com/network/index.html?adt=4&browser=ie&clientdata=ut%7c3.5.5.45852%7c290&geo=us&id=&ie=11&site=33049&uid=gGnNQ4MmOM9LtEpU&usermuted=0&w=1122893834&langs=enAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: cdn.bitmedianetwork.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /prodnews?v=3%2e5%2e5%2e1%2e45852 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: utorrent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /prodnews?v=3%2e5%2e5%2e1%2e45852 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.utorrent.com
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /partners/didomi/client-cmp-ut.min.html?langs=en HTTP/1.1Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: video.trontv.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /checkupdate.php?s=1&cl=uTorrent&v=111915804&i=64&l=en&svp=4&svn_revno=45852&tk=stable34&cmp=290&ocmp=290&period=8&sids=0,0,0,0,0&lv=4308514_0_&c=US&w=42EE000A&h=gGnNQ4MmOM9LtEpU&mts=31&gnc=1&nat_state=255&pc=12&sctl=1&shdi=1&def_tor=1&w64=1&skn=1&doainstalled=0&ie=9.11.17134.0&xim=1&sss=107&rtsb=107&view=win32&cmp=290&ocmp=290&db=ie&plus=3&pupsell=1&adc=1&ch_up=1?fg=1000&t_upP_=22937&t_downP_=79344&ssb=13256513503&ssu=13256513503&xseq=0&cau_time=0 HTTP/1.1Host: update.utorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /helper_ui/helper_web_ui.btinstall HTTP/1.1Host: btinstall-artifacts.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipContent-Type: application/x-www-form-urlencodedConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /images/mobile-icon.png HTTP/1.1Host: utclient.utorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipIf-Modified-Since: Sun, 1 Jan 1982 00:00:00 GMTConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /images/mobile-icon.png HTTP/1.1Host: utclient.utorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipIf-Modified-Since: Sun, 1 Jan 1982 00:00:00 GMTConnection: Close
Source: global traffic	HTTP traffic detected: GET /images/mobile-icon.png HTTP/1.1Host: utclient.utorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipIf-Modified-Since: Sun, 1 Jan 1982 00:00:00 GMTConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /images/mobile-icon.png HTTP/1.1Host: utclient.utorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipIf-Modified-Since: Sun, 1 Jan 1982 00:00:00 GMTConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close
Source: global traffic	HTTP traffic detected: GET /control/tags/ut.json HTTP/1.1Host: cdn.ap.bittorrent.comUser-Agent: BTWebClient/355S(45852)Accept-Encoding: gzipAccept-Language: en-USConnection: Close

Source: unknown

DNS traffic detected: queries for: router.utorrent.com

Source: unknown

HTTP traffic detected: POST /e?i=21 HTTP/1.1Host: i-21.b-45852.ut.bench.utorrent.comUser-Agent: ut_core BenchHttp (ver:45852)Connection: closeContent-Length: 276Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 35 31 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 73 69 6c 65 6e 74 5f 61 75 74 6f 75 70 64 61 74 65 22 2c 22 6c 61 75 6e 63 68 65 64 5f 74 61 72 67 65 74 22 3a 30 2c 22 75 70 64 61 74 65 64 22 3a 30 2c 22 72 65 6c 6f 63 61 74 65 64 22 3a 30 2c 22 76 65 72 73 69 6f 6e 73 22 3a 20 5b 5d 2c 20 22 61 63 74 69 6f 6e 22 3a 22 52 75 6e 6e 69 6e 67 45 6c 65 76 61 74 65 64 22 2c 20 22 67 5f 76 65 72 73 69 6f 6e 22 3a 31 31 31 39 31 35 38 30 34 2c 20 22 6e 6f 5f 73 61 75 22 3a 31 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039851,"eventName":"silent_autoupdate","launched_target":0,"updated":0,"relocated":0,"versions": [], "action":"RunningElevated", "g_version":111915804, "no_sau":1}

Source: uTorrent.exe	String found in binary or memory: http://1337x.to/search/%s/1/
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: uTorrent.exe	String found in binary or memory: http://bt3.t-ru.org/ann
Source: 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.478629268.00000000068E0000.00000004.00000001.sdmp	String found in binary or memory: http://bt3.t-ru.org/ann&echo.&echo
Source: uTorrent.exe	String found in binary or memory: http://bt4.t-ru.org/ann
Source: 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.478629268.00000000068E0000.00000004.00000001.sdmp	String found in binary or memory: http://bt4.t-ru.org/ann&echo.&echo
Source: 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp, uTorrent.exe	String found in binary or memory: http://btinstall-artifacts.bittorrent.com/helper/helper.btinstall
Source: 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://btinstall-artifacts.bittorrent.com/helper_ui/helper_ui.btinstall
Source: 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://btinstall-artifacts.bittorrent.com/helper_ui/helper_web_ui.btinstall
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495601373.00000000026FA000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.470573498.0000000003443000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.673861987.0000000003593000.00000004.00000001.sdmp	String found in binary or memory: http://counter-strike.com.ua/
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: uTorrent.exe	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: uTorrent.exe	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: uTorrent.exe	String found in binary or memory: http://google.com/search?q=torrent
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net02
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.478629268.00000000068E0000.00000004.00000001.sdmp, uTorrent.exe	String found in binary or memory: http://retracker.local/announce
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: uTorrent.exe	String found in binary or memory: http://trontv.com/#
Source: uTorrent.exe	String found in binary or memory: http://utorrent.com/prodnews
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://www.bittorrent.com0
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.470573498.0000000003443000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.673861987.0000000003593000.00000004.00000001.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://www.entrust.net/rpa0
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://www.entrust.net/rpa03
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.haysoft.org%1-k
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.267970883.000000007FD50000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.306519330.000000007FD50000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000000.311545909.0000000000401000.00000020.00020000.sdmp, PHO27fVEZKCoh9MD.exe, 00000010.00000003.406466182.000000007FD50000.00000004.00000001.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: 3yYh0IvfZPkSsqrl.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: yVn2ywuhEC.exe, 00000000.00000000.239895376.0000000140087000.00000008.00020000.sdmp, 3yYh0IvfZPkSsqrl.exe, 00000001.00000000.267070002.0000000000401000.00000020.00020000.sdmp, yVn2ywuhEC.exe, 00000002.00000000.269817660.0000000140087000.00000008.00020000.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000000.297092023.0000000000401000.00000020.00020000.sdmp, yVn2ywuhEC.exe, 00000008.00000000.304380149.0000000140087000.00000008.00020000.sdmp, PHO27fVEZKCoh9MD.exe, 00000010.00000000.388906847.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.672505177.0000000003575000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.org
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495612709.0000000002180000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.org1
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.org8
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.463282326.0000000003348000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.658787239.0000000003498000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgAbout
Source: 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.673861987.0000000003593000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgAcerca
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgApprupositu
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgInformazioni
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.470573498.0000000003443000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.673861987.0000000003593000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgKurulum
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.470573498.0000000003443000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.673861987.0000000003593000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgMun
Source: 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.673861987.0000000003593000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgO
Source: 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgOm
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgOver
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.470573498.0000000003443000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.673861987.0000000003593000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgPodaci
Source: 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgSobre
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgTelep
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgTietoja
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.kymoto.orgsQ
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.palkornel.hu/innosetup%1
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.267970883.000000007FD50000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.306519330.000000007FD50000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000000.311545909.0000000000401000.00000020.00020000.sdmp, PHO27fVEZKCoh9MD.exe, 00000010.00000003.406466182.000000007FD50000.00000004.00000001.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495877096.000000000228D000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.exe, 00000001.00000003.267420431.00000000023B0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	String found in binary or memory: http://www.utorrent.com/
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.480517418.00000000022FF000.00000004.00000001.sdmp	String found in binary or memory: http://www.utorrent.com/q
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.455095967.000000000665E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.483016018.0000000007E2E000.00000004.00000001.sdmp	String found in binary or memory: http://www.utorrent.com0
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllr
Source: uTorrent.exe	String found in binary or memory: https://api.bt.co/v1/rule/utclassic/
Source: uTorrent.exe	String found in binary or memory: https://btdig.com/search?q=
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://crashserver.bittorrent.com/upload
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: https://crashserver.bittorrent.com/uploadbt_con.socket_error
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: uTorrent.exe	String found in binary or memory: https://demonoid.is/files/?category=0&subcategory=0&quality=
Source: uTorrent.exe	String found in binary or memory: https://demonoid.is/files/?category=0&subcategory=0&quality=0&seeded=2&seeded=2&query
Source: uTorrent.exe	String found in binary or memory: https://demonoid.is/files/?category=0&subcategory=0&quality=0&seeded=2&seeded=2&query=
Source: uTorrent.exe	String found in binary or memory: https://extratorrent.ag/search/?search=
Source: 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	String found in binary or memory: https://forum.utorrent.com/topic/1820-flags/
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/netty/netty/issues/6520.
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/netty/netty/issues/6520.s
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://helper-catcher.bt.co/data/event-catcher-stream
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://helper-catcher.bt.co/data/event-catcher-streamwidtdrawaldepositpendingcompletefailed
Source: uTorrent.exe	String found in binary or memory: https://katcr.co/katsearch/page/1/
Source: uTorrent.exe	String found in binary or memory: https://media.adaware.com/torrentscanner/lp/search.php?p=bt&q=
Source: uTorrent.exe	String found in binary or memory: https://pirateiro.com/torrents/?search=
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://recaptcha.bittorrent.com/?adid=%1&publickey=%2&amount=%3
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://recaptcha.bittorrent.com/?adid=%1&publickey=%2&amount=%3learnMoreButtonsurveyButtonairdropBu
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: https://speed-dev.btt.network
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: https://speed-dev.btt.networkhttps://speed-staging.btt.networkhttps://speed.btt.networkenvtokenspend
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://speed-dev.trontv.com
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://speed-dev.trontv.comhttps://speed-staging.trontv.comhttps://speed.trontv.comenvtokenstatussp
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: https://speed-staging.btt.network
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://speed-staging.trontv.com
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: https://speed.btt.network
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://speed.trontv.com
Source: uTorrent.exe	String found in binary or memory: https://torrentz2.eu/search?f=
Source: uTorrent.exe	String found in binary or memory: https://utclient.utorrent.com/client-user-onboarding/second-entry-index.html
Source: yVn2ywuhEC.exe, 00000008.00000000.304380149.0000000140087000.00000008.00020000.sdmp	String found in binary or memory: https://www.bestchange.com
Source: yVn2ywuhEC.exe, 00000008.00000000.304380149.0000000140087000.00000008.00020000.sdmp	String found in binary or memory: https://www.bestchange.ru/
Source: 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://www.bittorrent.com/legal/privacy
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://www.bittorrent.com/legal/privacy/
Source: 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://www.bittorrent.com/legal/terms-of-use
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://www.bittorrent.com/legal/terms-of-use/
Source: 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://www.bittorrent.com/speed/faq/
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://www.bittorrent.com/wallet/
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://www.bittorrent.com/wallet/https://www.surveymonkey.com/r/BTSUI2019:/PurpleHomeIcon.png:/Grey
Source: yVn2ywuhEC.exe, 00000008.00000000.304380149.0000000140087000.00000008.00020000.sdmp	String found in binary or memory: https://www.getmonero.org/community/merchants/#exchanges
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: https://www.globalsign.com/repository/03
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://www.google-analytics.com/collect
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	String found in binary or memory: https://www.google-analytics.com/collectwww.google-analytics.comapplication/x-www-form-urlencodedv=U
Source: uTorrent.exe	String found in binary or memory: https://www.limetorrents.info/search/
Source: uTorrent.exe	String found in binary or memory: https://www.limetorrents.info/search/al
Source: uTorrent.exe	String found in binary or memory: https://www.skytorrents.to/?search=
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	String found in binary or memory: https://www.surveymonkey.com/r/BTSUI2019
Source: uTorrent.exe	String found in binary or memory: https://www.torlock.com/all/torrents/%s.html
Source: uTorrent.exe	String found in binary or memory: https://www.torrentdownloads.me/search/?search=
Source: uTorrent.exe	String found in binary or memory: https://www.torrentfunk.
Source: uTorrent.exe	String found in binary or memory: https://www.torrentfunk.com/all/torrents/%s.html
Source: uTorrent.exe	String found in binary or memory: https://yourbittorrent.com/?q=
Source: uTorrent.exe	String found in binary or memory: https://zooqle.com/search?q=

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: unknown	HTTPS traffic detected: 54.197.251.114:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.197.251.114:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.79.242.16:443 -> 192.168.2.3:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.154.93:443 -> 192.168.2.3:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.154.93:443 -> 192.168.2.3:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.228.74.189:443 -> 192.168.2.3:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.228.74.189:443 -> 192.168.2.3:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.79.242.16:443 -> 192.168.2.3:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.128:443 -> 192.168.2.3:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.128:443 -> 192.168.2.3:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.128:443 -> 192.168.2.3:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.155:443 -> 192.168.2.3:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.155:443 -> 192.168.2.3:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.14:443 -> 192.168.2.3:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.14:443 -> 192.168.2.3:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.214.78.220:443 -> 192.168.2.3:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.214.78.220:443 -> 192.168.2.3:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.12.157:443 -> 192.168.2.3:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.12.157:443 -> 192.168.2.3:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.14:443 -> 192.168.2.3:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.14:443 -> 192.168.2.3:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.131:443 -> 192.168.2.3:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.131:443 -> 192.168.2.3:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.208.194.17:443 -> 192.168.2.3:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.69:443 -> 192.168.2.3:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.69:443 -> 192.168.2.3:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.154.93:443 -> 192.168.2.3:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.236.79:443 -> 192.168.2.3:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.86.154.93:443 -> 192.168.2.3:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.86.137.113:443 -> 192.168.2.3:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.197.251.114:443 -> 192.168.2.3:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.79.242.16:443 -> 192.168.2.3:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.79.242.16:443 -> 192.168.2.3:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.197.251.114:443 -> 192.168.2.3:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.197.251.114:443 -> 192.168.2.3:49835 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Code function: 5_2_004344E0 GetObjectW,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

5_2_004344E0

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Code function: 5_2_0045C61C GetKeyboardState,

5_2_0045C61C

Spam, unwanted Advertisements and Ransom Demands:

Yara detected VovaLex Ransomware

Show sources

Source: Yara match	File source: yVn2ywuhEC.exe, type: SAMPLE
Source: Yara match	File source: 00000008.00000000.304380149.0000000140087000.00000008.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.239895376.0000000140087000.00000008.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.269817660.0000000140087000.00000008.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yVn2ywuhEC.exe PID: 5340, type: MEMORY
Source: Yara match	File source: Process Memory Space: yVn2ywuhEC.exe PID: 2168, type: MEMORY

Modifies the hosts file

Show sources

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Writes many files with high entropy

Show sources

Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe entropy: 7.99873946971	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe.vovalex entropy: 7.99908790789	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.vovalex entropy: 7.9998866926	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.vovalex entropy: 7.99968327711	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.vovalex entropy: 7.99078917601	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.vovalex entropy: 7.99982309856
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe entropy: 7.99873946971	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe.vovalex.vovalex entropy: 7.99925797837	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.vovalex.vovalex entropy: 7.999886413	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.vovalex.vovalex entropy: 7.99971774032	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.vovalex entropy: 7.99981041168
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe entropy: 7.99873946971	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe.vovalex.vovalex.vovalex entropy: 7.99927122225	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.vovalex.vovalex.vovalex entropy: 7.99988665927	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.vovalex.vovalex.vovalex entropy: 7.9997437342	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.vovalex entropy: 7.99933547354	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 entropy: 7.99545016162	Jump to dropped file

System Summary:

Source: C:\Users\user\Desktop\yVn2ywuhEC.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Code function: 5_2_00480964: CreateFileW,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

5_2_00480964

Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_0040E550 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_0040E550
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004B0418 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		5_2_004B0418

Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_00402260	1_2_00402260
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_004122AF	1_2_004122AF
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_0040D33C	1_2_0040D33C
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_0041259C	1_2_0041259C
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004E4364	5_2_004E4364
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00473790	5_2_00473790
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004E3800	5_2_004E3800
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0049E1A4	5_2_0049E1A4
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00402474	5_2_00402474
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004AC4E8	5_2_004AC4E8
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004FE728	5_2_004FE728
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0044A7C4	5_2_0044A7C4
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004EC918	5_2_004EC918
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00488CF0	5_2_00488CF0
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004BB578	5_2_004BB578
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00453668	5_2_00453668
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004077F8	5_2_004077F8
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004EB864	5_2_004EB864
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00481D1C	5_2_00481D1C
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Code function: 29_3_00B6C9D7	29_3_00B6C9D7

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: String function: 00409620 appears 151 times
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: String function: 00406914 appears 41 times
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: String function: 004B2F34 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: String function: 0049EBD8 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: String function: 004ADE4C appears 38 times
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: String function: 004B31B8 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: String function: 0049EEBC appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: String function: 0040C2BC appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: String function: 00487D38 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: String function: 00404C88 appears 36 times

Source: 3yYh0IvfZPkSsqrl.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 3yYh0IvfZPkSsqrl.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-VGHOK.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-VGHOK.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: 0i1CtyGdkmLhJnVs.tmp.6.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 0i1CtyGdkmLhJnVs.tmp.6.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-JP462.tmp.13.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-JP462.tmp.13.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: _iu14D2N.tmp.38.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: _iu14D2N.tmp.38.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: yVn2ywuhEC.exe

Static PE information: Number of sections : 11 > 10

Source: yVn2ywuhEC.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 3yYh0IvfZPkSsqrl.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 3yYh0IvfZPkSsqrl.tmp.1.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 3yYh0IvfZPkSsqrl.tmp.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 0i1CtyGdkmLhJnVs.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-VGHOK.tmp.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: is-VGHOK.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 0i1CtyGdkmLhJnVs.tmp.6.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 0i1CtyGdkmLhJnVs.tmp.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PHO27fVEZKCoh9MD.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JP462.tmp.13.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: is-JP462.tmp.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: _iu14D2N.tmp.38.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: _iu14D2N.tmp.38.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: utt5E55.tmp.29.dr

Static PE information: No import functions for PE file found

Source: utt5E55.tmp.29.dr

Static PE information: Section .text

Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	Binary or memory string: rreisa.nomoneycom.rosoundandvision.museumcom.safukui.fukui.jpcom.sborg.htkuriyama.hokkaido.jpmaibara.shiga.jpcom.scorg.hucom.sdsoma.fukushima.jptomi.nagano.jpcom.secom.rucom.rwcom.sgcom.shaccenturene.ugorg.ilorg.iminazawa.aichi.jpsoni.nara.jpcom.slne.tzorg.inhisamitsucom.sncom.soorg.iqorg.irorg.isorg.jecom.stintl.tnne.usnom.adcom.svarte.bonom.aeembetsu.hokkaido.jpnom.aghigashitsuno.kochi.jpcom.syfireoizumi.gunma.jpnakagawa.tokushima.jpcom.tjcam.itnom.aimotoyama.kochi.jpcom.tmtel.trjetzt.jmorg.jocom.tnservebbs.netnom.alcom.tous-west-1.elasticbeanstalk.comkawachinagano.osaka.jpvestre-toten.nocom.uatwmail.cccom.trcom.ttnyc.mn.keorg.kgcom.twcom.ugorg.kiphoto*.khboatstrentinoalto-adige.itorg.kmleka.nofishasaminami.hiroshima.jporg.kneid.nosakae.chiba.jpwsa.gov.plitako.ibaraki.jporg.kporg.la
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	Binary or memory string: pwcnet.slnet.sokawai.nara.jpminamiminowa.nagano.jpmuika.niigata.jplanbib.seal.eu.orgyoshida.saitama.jpnet.stfarmersfrom-vt.compisa.ityamato.kanagawa.jpnet.thminamisanriku.miyagi.jpnet.syis-a-personaltrainer.comnet.tjtechnologypa.ittrentinosuedtirol.itnet.tmnet.tnavoues.frogose.saitama.jpnet.tochikushino.fukuoka.jpnet.uanet.trwitd.gov.plnet.ttkg.krnet.twrailroad.museumtorayyura.wakayama.jppagehosting-cluster.nlhjartdal.nonet.ukcloudns.bizcomputer.museumnet.vcnet.vestj

Source: classification engine

Classification label: mal40.rans.adwa.evad.winEXE@48/93@94/98

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Code function: 5_2_0043293C GetLastError,FormatMessageW,

5_2_0043293C

Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_0040E550 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_0040E550
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004B0418 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		5_2_004B0418

Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe

Code function: 1_2_0040805C GetDiskFreeSpaceW,

1_2_0040805C

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Code function: 5_2_004CCDB4 GetVersion,CoCreateInstance,

5_2_004CCDB4

Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe

Code function: 1_2_0040EE2C FindResourceW,SizeofResource,LoadResource,LockResource,

1_2_0040EE2C

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3820:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5572:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5580:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5984:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5772:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5956:120:WilError_01
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ Torrent4823DF041B09
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1260:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5204:120:WilError_01
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\uTorrent.exe

Source: C:\Users\user\Desktop\yVn2ywuhEC.exe

File created: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe

Jump to behavior

Source: yVn2ywuhEC.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\unins000.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\yVn2ywuhEC.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	Binary or memory string: create table ui_store (path text primary key not null,content_type text,data blob not null);
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	Binary or memory string: create table historical_spending (spending integer not null default 0,timestamp integer not null default (strftime('%s','now')));
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	Binary or memory string: create table historical_totals (spending integer not null default 0,earning integer not null default 0,downloaded integer not null default 0,seeded integer not null default 0);
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	Binary or memory string: insert or replace into historical_totals (spending, earning, downloaded, seeded) values (0,0,0,0);
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	Binary or memory string: create table on_chain_recent_txns (txn_id text primary key not null,id integer not null,token_type integer,amount integer not null check(amount > 0),created integer,message text,reported integer default 0,type integer,status integer,asset_name text,from_address text,to_address text);
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	Binary or memory string: create table exchange_withdrawals (withdrawal_id integer primary key not null,amount integer not null check(amount > 0),channel_id integer unique default null references outgoing_channels,exchange_id integer unique default null,exchange_account blob default null,accepted integer not null default 0,last_attempt integer not null default (strftime('%s','now')),num_attempts integer not null default 1);create table exchange_deposits (deposit_id integer primary key not null,amount integer not null check(amount > 0),ledger_channel_id integer unique default null references incoming_channels,exchange_id integer unique default null,tron_tx blob default null,accepted integer not null default 0,last_attempt integer not null default (strftime('%s','now')),num_attempts integer not null default 1);
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	Binary or memory string: create table airdrops (adid text primary key not null,gift_amount integer,claim_status integer,active integer,expired integer,claim_time integer,type integer default 0,level integer default 0,time_limit integer default 0);
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	Binary or memory string: create table hourly_spending (spending integer not null default 0,timestamp integer not null default (strftime('%s','now')));
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	Binary or memory string: create table on_chain_account_balances (asset_id integer primary key not null,asset_name integer not null,amount integer);
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	Binary or memory string: create table on_chain_pending_txns (txn_id text,id integer primary key not null,token_type integer,amount integer not null check(amount > 0),created integer,message text,reported integer default 0,type integer,status integer,asset_name text,from_address text,to_address text,data_source integer default 1);
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	Binary or memory string: create table int_settings (key integer primary key not null, value integer not null default 0);create table string_settings (key integer primary key not null, value text not null default "");create table blob_settings (key integer primary key not null, value blob not null default (zeroblob(0)));create table outgoing_channels (channel_id integer primary key not null,ledger_channel_id integer unique default null,seq integer default 1,created integer,closed integer default null,our_balance integer not null check(our_balance >= 0),their_balance integer not null check(their_balance >= 0),their_pk blob not null);create table incoming_channels (ledger_channel_id integer primary key not null,confirmed integer not null default 0,seq integer not null,closed integer default null,our_balance integer not null check(our_balance >= 0),their_balance integer not null check(their_balance >= 0),their_pk blob,state blob,thier_sig blob);
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	Binary or memory string: create table hourly_earning (earning integer not null default 0,timestamp integer not null default (strftime('%s','now')));
Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	Binary or memory string: create table historical_earning (earning integer not null default 0,timestamp integer not null default (strftime('%s','now')));

Source: yVn2ywuhEC.exe	Virustotal: Detection: 47%
Source: yVn2ywuhEC.exe	Metadefender: Detection: 13%
Source: yVn2ywuhEC.exe	ReversingLabs: Detection: 39%

Source: 3yYh0IvfZPkSsqrl.exe

String found in binary or memory: rting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked the co

Source: unknown	Process created: C:\Users\user\Desktop\yVn2ywuhEC.exe 'C:\Users\user\Desktop\yVn2ywuhEC.exe' -install
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe
Source: unknown	Process created: C:\Users\user\Desktop\yVn2ywuhEC.exe 'C:\Users\user\Desktop\yVn2ywuhEC.exe' /install
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp 'C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp' /SL5='$B0076,31402076,326656,C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe
Source: unknown	Process created: C:\Users\user\Desktop\yVn2ywuhEC.exe 'C:\Users\user\Desktop\yVn2ywuhEC.exe' /load
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp 'C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp' /SL5='$60238,31402076,326656,C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe
Source: unknown	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent (TCP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent (UDP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp 'C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp' /SL5='$303F2,31402076,326656,C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
Source: unknown	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent (TCP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent (UDP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\uTorrent\unins000.exe C:\Users\user\AppData\Roaming\uTorrent\unins000.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\_iu14D2N.tmp 'C:\Users\user\AppData\Local\Temp\_iu14D2N.tmp' /SECONDPHASE='C:\Users\user\AppData\Roaming\uTorrent\unins000.exe' /FIRSTPHASEWND=$1700C2
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	Process created: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp 'C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp' /SL5='$B0076,31402076,326656,C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe'	Jump to behavior
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	Process created: C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent (TCP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent (UDP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Process created: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp 'C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp' /SL5='$60238,31402076,326656,C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe'	Jump to behavior
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	Process created: C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent (TCP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent (UDP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	Process created: C:\Users\user\AppData\Roaming\uTorrent\unins000.exe C:\Users\user\AppData\Roaming\uTorrent\unins000.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\unins000.exe	Process created: C:\Users\user\AppData\Local\Temp\_iu14D2N.tmp 'C:\Users\user\AppData\Local\Temp\_iu14D2N.tmp' /SECONDPHASE='C:\Users\user\AppData\Roaming\uTorrent\unins000.exe' /FIRSTPHASEWND=$1700C2

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	Automated click: OK

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Window detected: Number of UI elements: 38

Source: yVn2ywuhEC.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: yVn2ywuhEC.exe

Static file information: File size 32864256 > 1048576

Source: yVn2ywuhEC.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1eb7200

Source: yVn2ywuhEC.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: d:\Projects\WinRAR\SFX\build\sfxzip32\Release\sfxzip.pdb source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp
Source:	Binary string: X:\jenkins-workspace\workspace\token-wallet-pipeline\build\MinSizeRel\helper.pdb source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.455095967.000000000665E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.483016018.0000000007E2E000.00000004.00000001.sdmp

Source: yVn2ywuhEC.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: yVn2ywuhEC.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: yVn2ywuhEC.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: yVn2ywuhEC.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: yVn2ywuhEC.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Source: yVn2ywuhEC.exe	Static PE information: section name: ._deh
Source: yVn2ywuhEC.exe	Static PE information: section name: .dp
Source: yVn2ywuhEC.exe	Static PE information: section name: .minfo
Source: yVn2ywuhEC.exe	Static PE information: section name: .tp

Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_0040D034 push ecx; mov dword ptr [esp], eax	1_2_0040D039
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_0040E0E8 push 0040E130h; ret	1_2_0040E128
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_004100F0 push 00410158h; ret	1_2_00410150
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_00406944 push 00406986h; ret	1_2_0040697E
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_0040B104 push 0040B2B0h; ret	1_2_0040B2A8
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_00406A50 push 00406A88h; ret	1_2_00406A80
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_0040E268 push 0040E294h; ret	1_2_0040E28C
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_00406A92 push 00406AC0h; ret	1_2_00406AB8
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_00406A94 push 00406AC0h; ret	1_2_00406AB8
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_004064A6 push 0040650Dh; ret	1_2_00406505
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_004064A8 push 0040650Dh; ret	1_2_00406505
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_004034A8 push eax; ret	1_2_004034E4
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_0040DD50 push 0040DD93h; ret	1_2_0040DD8B
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_004115BC push 0041163Ah; ret	1_2_00411632
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_00411658 push 00411685h; ret	1_2_0041167D
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0049D3D4 push 0049D97Fh; ret	5_2_0049D977
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0046E148 push ecx; mov dword ptr [esp], edx	5_2_0046E14C
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004B2170 push 004B21A3h; ret	5_2_004B219B
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0042E24C push 0042E278h; ret	5_2_0042E270
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00482208 push 0048224Bh; ret	5_2_00482243
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0040A2C4 push 0040A306h; ret	5_2_0040A2FE
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0047E2CC push 0047E326h; ret	5_2_0047E31E
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0044C28C push 0044C2B8h; ret	5_2_0044C2B0
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0045C35C push ecx; mov dword ptr [esp], ecx	5_2_0045C360
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004AC308 push 004AC350h; ret	5_2_004AC348
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0040A3D0 push 0040A408h; ret	5_2_0040A400
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00454394 push 004543FFh; ret	5_2_004543F7
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0049C400 push ecx; mov dword ptr [esp], ecx	5_2_0049C404
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0040A414 push 0040A440h; ret	5_2_0040A438
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004AC4E8 push ecx; mov dword ptr [esp], eax	5_2_004AC4ED
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0046E49C push ecx; mov dword ptr [esp], edx	5_2_0046E4A0

Persistence and Installation Behavior:

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	File created: C:\Users\user\AppData\Roaming\uTorrent\is-8L18J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	File created: C:\Users\user\AppData\Local\Temp\is-50A2H.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	File created: C:\Users\user\AppData\Roaming\uTorrent\helper\is-LK0VG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	File created: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	File created: C:\Users\user\AppData\Roaming\uTorrent\is-87BJR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	File created: C:\Users\user\AppData\Local\Temp\utt5E55.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe	File created: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\uTorrent\unins000.exe	File created: C:\Users\user\AppData\Local\Temp\_iu14D2N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	File created: C:\Users\user\AppData\Roaming\uTorrent\is-JP462.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	File created: C:\Users\user\AppData\Roaming\uTorrent\helper\is-ET7D6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	File created: C:\Users\user\AppData\Roaming\uTorrent\is-AVBP3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	File created: C:\Users\user\AppData\Roaming\uTorrent\is-N5OCA.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	File created: C:\Users\user\AppData\Roaming\uTorrent\is-VGHOK.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File created: C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	File created: C:\Users\user\AppData\Local\Temp\is-SMFB9.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	File created: C:\Users\user\AppData\Local\Temp\is-DRN6C.tmp\_isetup\_setup64.tmp	Jump to dropped file

Boot Survival:

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\uTorrent.lnk			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\uTorrent.lnk			Jump to behavior

Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run uTorrent			Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run uTorrent			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00470B44 GetWindowLongW,IsIconic,IsWindowVisible,ShowWindow,SetWindowLongW,SetWindowLongW,ShowWindow,ShowWindow,	5_2_00470B44
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00473790 IsIconic,SetFocus,GetParent,SaveDC,RestoreDC,GetWindowDC,SaveDC,RestoreDC,	5_2_00473790
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00470AC4 IsIconic,	5_2_00470AC4
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00462A84 IsIconic,GetCapture,	5_2_00462A84
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004812D0 IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,MessageBoxW,SetActiveWindow,	5_2_004812D0
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004633F4 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	5_2_004633F4
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_0042DC64 IsIconic,GetWindowPlacement,GetWindowRect,	5_2_0042DC64
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00463E60 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongW,GetWindowLongW,GetWindowLongW,ScreenToClient,ScreenToClient,	5_2_00463E60

Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\uTorrent\unins000.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\uTorrent\unins000.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\uTorrent\unins000.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\uTorrent\unins000.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\uTorrent\unins000.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

File opened: HKEY_CURRENT_USER\Software\Wine

Jump to behavior

Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Code function: GetCurrentThreadId,GetCursorPos,WaitForSingleObject,

5_2_0047A598

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\uTorrent\is-8L18J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-50A2H.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\uTorrent\helper\is-LK0VG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\uTorrent\is-87BJR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\uTorrent\is-JP462.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\uTorrent\helper\is-ET7D6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\uTorrent\is-VGHOK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-SMFB9.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-DRN6C.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe TID: 4924

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\unins000.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	File Volume queried: C:\Users\user\AppData\Roaming\uTorrent\share FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: 1_2_00405BEC GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	1_2_00405BEC
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004AD600 FindFirstFileW,GetLastError,	5_2_004AD600
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_00408174 GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	5_2_00408174
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: 5_2_004FFC74 FindFirstFileW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,	5_2_004FFC74

Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe

Code function: 1_2_00406458 GetSystemInfo,

1_2_00406458

Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000002.496900520.00000000022C0000.00000002.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000002.488453629.00000000027C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000002.496900520.00000000022C0000.00000002.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000002.488453629.00000000027C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000002.496900520.00000000022C0000.00000002.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000002.488453629.00000000027C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: 3yYh0IvfZPkSsqrl.exe, 00000001.00000002.496900520.00000000022C0000.00000002.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000002.488453629.00000000027C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Modifies the hosts file

Show sources

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Code function: 5_2_004DA4C8 ShellExecuteExW,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

5_2_004DA4C8

Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	Process created: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Jump to behavior
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	Process created: C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe	Jump to behavior
Source: C:\Users\user\Desktop\yVn2ywuhEC.exe	Process created: C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Code function: 5_2_00480ED0 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,

5_2_00480ED0

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Code function: 5_2_00480084 AllocateAndInitializeSid,GetVersion,GetModuleHandleW,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

5_2_00480084

Source: 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.451382160.0000000005110000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.478629268.00000000068E0000.00000004.00000001.sdmp

Binary or memory string: ASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALT0409000208090710050EASC 0%dupdownonoff0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Language, Device and Operating System Detection:

Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: GetModuleFileNameW,RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,lstrcpynW,GetThreadLocale,GetLocaleInfoW,lstrlenW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,	1_2_00405DE8
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: GetLocaleInfoW,	1_2_0040E658
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: GetLocaleInfoW,	1_2_00408EB4
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: GetLocaleInfoW,	1_2_00408F00
Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	Code function: lstrcpynW,GetThreadLocale,GetLocaleInfoW,lstrlenW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,	1_2_00405F23
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: GetModuleFileNameW,RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,lstrcpynW,GetThreadLocale,GetLocaleInfoW,lstrlenW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,	5_2_00408370
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: lstrcpynW,GetThreadLocale,GetLocaleInfoW,lstrlenW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,	5_2_004084AB
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: GetLocaleInfoW,	5_2_0041107C
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: GetLocaleInfoW,	5_2_00411030
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Code function: GetLocaleInfoW,	5_2_004B1118

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Queries volume information: C:\Users\user\AppData\Roaming\uTorrent\helper\helper.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Queries volume information: C:\Users\user\AppData\Roaming\uTorrent\utorrent-355-45852.chm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Queries volume information: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Queries volume information: C:\Users\user\AppData\Roaming\uTorrent\updates VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Code function: 5_2_004B39E4 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeW,GetLastError,CreateFileW,SetNamedPipeHandleState,CreateProcessW,CloseHandle,CloseHandle,

5_2_004B39E4

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

Code function: 5_2_004B2BD4 GetSystemTimeAsFileTime,FileTimeToSystemTime,

5_2_004B2BD4

Source: C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe

Code function: 1_2_004110C4 GetModuleHandleW,GetVersion,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetProcessDEPPolicy,

1_2_004110C4

Source: C:\Users\user\Desktop\yVn2ywuhEC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Modifies the hosts file

Show sources

Source: C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Modifies the windows firewall

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: unknown

Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe	Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Spearphishing Link1	Scripting1	Registry Run Keys / Startup Folder11	Exploitation for Privilege Escalation1	Disable or Modify Tools2	Input Capture11	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Access Token Manipulation1	File and Directory Permissions Modification1	LSASS Memory	File and Directory Discovery2	Remote Desktop Protocol	Screen Capture1	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Process Injection13	Deobfuscate/Decode Files or Information1	Security Account Manager	System Information Discovery37	SMB/Windows Admin Shares	Input Capture11	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Registry Run Keys / Startup Folder11	Scripting1	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	Security Software Discovery121	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol24	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing1	Cached Domain Credentials	Virtualization/Sandbox Evasion2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Masquerading1	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Virtualization/Sandbox Evasion2	Proc Filesystem	Application Window Discovery11	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Modify Registry1	/etc/passwd and /etc/shadow	System Owner/User Discovery2	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Process Injection13	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yVn2ywuhEC.exe	48%	Virustotal		Browse
yVn2ywuhEC.exe	14%	Metadefender		Browse
yVn2ywuhEC.exe	39%	ReversingLabs	Win64.Ransomware.Vovalex

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe	6%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe	10%	ReversingLabs
C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	6%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe	10%	ReversingLabs
C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe	6%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe	10%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-50A2H.tmp\_isetup\_setup64.tmp	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\is-50A2H.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp	6%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp	6%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-DRN6C.tmp\_isetup\_setup64.tmp	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\is-DRN6C.tmp\_isetup\_setup64.tmp	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
29.0.uTorrent.exe.400000.0.unpack	100%	Avira	TR/Crypt.ULPM.Gen		Download File

Domains

Source	Detection	Scanner	Link
s.zkcdn.net	0%	Virustotal	Browse
platform.twitter.map.fastly.net	0%	Virustotal	Browse
sdk.privacy-center.org	0%	Virustotal	Browse
static.ads-twitter.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://www.kymoto.orgKurulum	0%	Avira URL Cloud	safe
https://demonoid.is/files/?category=0&subcategory=0&quality=0&seeded=2&seeded=2&query	0%	Avira URL Cloud	safe
https://speed-dev.trontv.com	0%	Avira URL Cloud	safe
http://www.kymoto.orgSobre	0%	Avira URL Cloud	safe
http://www.kymoto.orgTietoja	0%	Avira URL Cloud	safe
https://www.torrentfunk.	0%	Avira URL Cloud	safe
http://www.palkornel.hu/innosetup%1	0%	URL Reputation	safe
http://www.palkornel.hu/innosetup%1	0%	URL Reputation	safe
http://www.palkornel.hu/innosetup%1	0%	URL Reputation	safe
http://www.kymoto.orgO	0%	Avira URL Cloud	safe
https://www.skytorrents.to/?search=	0%	Avira URL Cloud	safe
http://www.innosetup.com/	0%	URL Reputation	safe
http://www.innosetup.com/	0%	URL Reputation	safe
http://www.innosetup.com/	0%	URL Reputation	safe
http://www.kymoto.orgOver	0%	Avira URL Cloud	safe
http://www.kymoto.orgAbout	0%	Avira URL Cloud	safe
http://www.kymoto.orgPodaci	0%	Avira URL Cloud	safe
http://www.kymoto.orgApprupositu	0%	Avira URL Cloud	safe
http://www.kymoto.org8	0%	Avira URL Cloud	safe
http://www.kymoto.orgMun	0%	Avira URL Cloud	safe
http://www.kymoto.org1	0%	Avira URL Cloud	safe
http://www.kymoto.orgsQ	0%	Avira URL Cloud	safe
http://www.haysoft.org%1-k	0%	Avira URL Cloud	safe
https://www.limetorrents.info/search/	0%	Avira URL Cloud	safe
https://speed-staging.trontv.com	0%	Avira URL Cloud	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://www.kymoto.orgInformazioni	0%	Avira URL Cloud	safe
http://video.trontv.com/partners/didomi/client-cmp-ut.min.html?langs=en	0%	Avira URL Cloud	safe
https://demonoid.is/files/?category=0&subcategory=0&quality=	0%	Avira URL Cloud	safe
http://www.kymoto.orgOm	0%	Avira URL Cloud	safe
https://www.limetorrents.info/search/al	0%	Avira URL Cloud	safe
http://www.bittorrent.com0	0%	Avira URL Cloud	safe
http://counter-strike.com.ua/	0%	URL Reputation	safe
http://counter-strike.com.ua/	0%	URL Reputation	safe
http://counter-strike.com.ua/	0%	URL Reputation	safe
https://speed.btt.network	0%	Avira URL Cloud	safe
https://speed-staging.btt.network	0%	Avira URL Cloud	safe
https://demonoid.is/files/?category=0&subcategory=0&quality=0&seeded=2&seeded=2&query=	0%	Avira URL Cloud	safe
https://speed-dev.trontv.comhttps://speed-staging.trontv.comhttps://speed.trontv.comenvtokenstatussp	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
utorrent.com	98.143.146.7	true	false		high
stats.l.doubleclick.net	108.177.127.155	true	false		high
s.twitter.com	104.244.42.131	true	false		high
global.px.quantserve.com	91.228.74.189	true	false		high
com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com	50.17.220.153	true	false		high
p13nlog-1106815646.us-east-1.elb.amazonaws.com	54.208.194.17	true	false		high
update.utorrent.com	67.215.246.203	true	false		high
d2adxpv8ev13tq.cloudfront.net	13.226.169.10	true	false		high
update.bittorrent.com	173.254.195.58	true	false		high
s.zkcdn.net	13.226.169.14	true	false	0%, Virustotal, Browse	unknown
eqx.smartadserver.com	185.86.137.113	true	false		high
platform.twitter.map.fastly.net	151.101.12.157	true	false	0%, Virustotal, Browse	unknown
sdk.privacy-center.org	99.86.154.93	true	false	0%, Virustotal, Browse	unknown
scontent.xx.fbcdn.net	31.13.92.14	true	false		high
router.bittorrent.com	67.215.246.10	true	false		high
d30v41vhco8ky9.cloudfront.net	13.226.169.128	true	false		high
t.co	104.244.42.69	true	false		high
bittorrent-1.hs.llnwd.net	178.79.242.147	true	false		high
s3-website-us-east-1.amazonaws.com	52.217.98.3	true	false		high
bittorrent-4.hs.llnwd.net	178.79.242.16	true	false		high
router.utorrent.com	82.221.103.244	true	false		high
bittorrent-2.hs.llnwd.net	178.79.242.181	true	false		high
prod-classic-log-1849103161.us-east-1.elb.amazonaws.com	3.214.78.220	true	false		high
media.adaware.com	104.16.236.79	true	false		high
i-49.b-45852.ut.bench.utorrent.com	unknown	unknown	false		high
static.ads-twitter.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
video.trontv.com	unknown	unknown	true		unknown
i-1006.b-0.ad.bench.utorrent.com	unknown	unknown	false		high
www9.smartadserver.com	unknown	unknown	false		high
cdn-assets.bittorrent.com	unknown	unknown	false		high
ssum.casalemedia.com	unknown	unknown	false		high
i-38.b-45852.ut.bench.utorrent.com	unknown	unknown	false		high
cdn.bitmedianetwork.com	unknown	unknown	false		high
i-20.b-45852.ut.bench.utorrent.com	unknown	unknown	false		high
stats.g.doubleclick.net	unknown	unknown	false		high
cdn.ap.bittorrent.com	unknown	unknown	false		high
i-3100.b-0.ad.bench.utorrent.com	unknown	unknown	false		high
code.jquery.com	unknown	unknown	false		high
i-43.b-45852.ut.bench.utorrent.com	unknown	unknown	false		high
i-30.b-45852.ut.bench.utorrent.com	unknown	unknown	false		high
www.utorrent.com	unknown	unknown	false		high
a8230037.cdn.optimizely.com	unknown	unknown	false		high
i-62.b-45852.ut.bench.utorrent.com	unknown	unknown	false		high
logx.optimizely.com	unknown	unknown	false		high
i-21.b-45852.ut.bench.utorrent.com	unknown	unknown	false		high
i-29.b-45852.ut.bench.utorrent.com	unknown	unknown	false		high
i-32.b-45852.ut.bench.utorrent.com	unknown	unknown	false		high
secure.quantserve.com	unknown	unknown	false		high
www.bt.co	unknown	unknown	false		high
cdn3.optimizely.com	unknown	unknown	false		high
50136351.log.optimizely.com	unknown	unknown	false		high
connect.facebook.net	unknown	unknown	false		high
i-61.b-45852.ut.bench.utorrent.com	unknown	unknown	false		high
i-67.b-45852.ut.bench.utorrent.com	unknown	unknown	false		high
i-64.b-45852.ut.bench.utorrent.com	unknown	unknown	false		high
analytics.twitter.com	unknown	unknown	false		high
cdn.optimizely.com	unknown	unknown	false		high
btinstall-artifacts.bittorrent.com	unknown	unknown	false		high
utclient.utorrent.com	unknown	unknown	false		high
i-5600.b-1327.helper.bench.utorrent.com	unknown	unknown	false		high
apps.bittorrent.com	unknown	unknown	false		high
i-34.b-45852.ut.bench.utorrent.com	unknown	unknown	false		high
engine.bitmedianetwork.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.utorrent.com/prodnews?v=3%2e5%2e5%2e1%2e45852	false		high
http://i-29.b-45852.ut.bench.utorrent.com/e?i=29	false		high
http://cdn.bitmedianetwork.com/network/assets/css/styles.css	false		high
http://i-61.b-45852.ut.bench.utorrent.com/e?i=61	false		high
http://i-38.b-45852.ut.bench.utorrent.com/e?i=38	false		high
http://i-5600.b-1327.helper.bench.utorrent.com/e.php?i=5600	false		high
http://i-34.b-45852.ut.bench.utorrent.com/e?i=34	false		high
http://update.utorrent.com/checkupdate.php?s=1&cl=uTorrent&v=111915804&i=64&l=en&svp=4&svn_revno=45852&tk=stable34&cmp=290&ocmp=290&period=8&sids=0,0,0,0,0&lv=4308514_0_&c=US&w=42EE000A&h=gGnNQ4MmOM9LtEpU&mts=31&gnc=1&nat_state=255&pc=12&sctl=1&shdi=1&def_tor=1&w64=1&skn=1&doainstalled=0&ie=9.11.17134.0&xim=1&sss=107&rtsb=107&view=win32&cmp=290&ocmp=290&db=ie&plus=3&pupsell=1&adc=1&ch_up=1?fg=1000&t_upP_=22937&t_downP_=79344&ssb=13256513503&ssu=13256513503&xseq=0&cau_time=0	false		high
http://i-67.b-45852.ut.bench.utorrent.com/e?i=67	false		high
http://i-43.b-45852.ut.bench.utorrent.com/e?i=43	false		high
http://i-49.b-45852.ut.bench.utorrent.com/e?i=49	false		high
http://i-32.b-45852.ut.bench.utorrent.com/e?i=32	false		high
http://apps.bittorrent.com/utorrent-onboarding/player.btapp	false		high
http://i-62.b-45852.ut.bench.utorrent.com/e?i=62	false		high
http://i-30.b-45852.ut.bench.utorrent.com/e?i=30	false		high
http://cdn.bitmedianetwork.com/adzerk/ados-bt.js	false		high
http://utclient.utorrent.com/images/mobile-icon.png	false		high
http://i-64.b-45852.ut.bench.utorrent.com/e?i=64	false		high
http://cdn.bitmedianetwork.com/network/index.html?adt=4&browser=ie&clientdata=ut%7c3%2e5%2e5%2e45852%7c290&geo=us&id=&ie=11&site=33049&uid=gGnNQ4MmOM9LtEpU&usermuted=0&w=1122893834&langs=en	false		high
http://cdn.bitmedianetwork.com/assets/js/index-bundled.js	false		high
http://video.trontv.com/partners/didomi/client-cmp-ut.min.html?langs=en	false	Avira URL Cloud: safe	unknown
http://i-21.b-45852.ut.bench.utorrent.com/e?i=21	false		high
http://cdn.ap.bittorrent.com/control/tags/ut.json	false		high
http://cdn.ap.bittorrent.com/control/feature/tags/ut.json	false		high
http://i-20.b-45852.ut.bench.utorrent.com/e?i=20	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.kymoto.orgKurulum	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.470573498.0000000003443000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.673861987.0000000003593000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.utorrent.com/q	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.480517418.00000000022FF000.00000004.00000001.sdmp	false		high
http://bt4.t-ru.org/ann&echo.&echo	0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.478629268.00000000068E0000.00000004.00000001.sdmp	false		high
https://www.bestchange.ru/	yVn2ywuhEC.exe, 00000008.00000000.304380149.0000000140087000.00000008.00020000.sdmp	false		high
https://demonoid.is/files/?category=0&subcategory=0&quality=0&seeded=2&seeded=2&query	uTorrent.exe	false	Avira URL Cloud: safe	unknown
http://utorrent.com/prodnews	uTorrent.exe	false		high
https://crashserver.bittorrent.com/upload	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false		high
https://api.bt.co/v1/rule/utclassic/	uTorrent.exe	false		high
https://speed-dev.trontv.com	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://yourbittorrent.com/?q=	uTorrent.exe	false		high
http://www.kymoto.orgSobre	0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kymoto.orgTietoja	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://katcr.co/katsearch/page/1/	uTorrent.exe	false		high
https://www.torrentfunk.	uTorrent.exe	false	Avira URL Cloud: safe	unknown
http://www.palkornel.hu/innosetup%1	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.entrust.net/rpa0	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false		high
http://www.kymoto.orgO	0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.673861987.0000000003593000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.skytorrents.to/?search=	uTorrent.exe	false	Avira URL Cloud: safe	unknown
http://www.innosetup.com/	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.267970883.000000007FD50000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.306519330.000000007FD50000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000000.311545909.0000000000401000.00000020.00020000.sdmp, PHO27fVEZKCoh9MD.exe, 00000010.00000003.406466182.000000007FD50000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.torrentfunk.com/all/torrents/%s.html	uTorrent.exe	false		high
https://www.bittorrent.com/wallet/https://www.surveymonkey.com/r/BTSUI2019:/PurpleHomeIcon.png:/Grey	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false		high
http://www.kymoto.orgOver	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kymoto.orgAbout	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.463282326.0000000003348000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.658787239.0000000003498000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kymoto.orgPodaci	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.470573498.0000000003443000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.673861987.0000000003593000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa03	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false		high
http://www.kymoto.orgApprupositu	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://helper-catcher.bt.co/data/event-catcher-stream	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false		high
https://www.surveymonkey.com/r/BTSUI2019	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false		high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	3yYh0IvfZPkSsqrl.exe	false		high
http://www.kymoto.org8	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://forum.utorrent.com/topic/1820-flags/	0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	false		high
http://www.kymoto.orgMun	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.470573498.0000000003443000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.673861987.0000000003593000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kymoto.org	0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.672505177.0000000003575000.00000004.00000001.sdmp	false		high
https://www.bittorrent.com/wallet/	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false		high
http://www.kymoto.org1	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495612709.0000000002180000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false		high
http://bt3.t-ru.org/ann&echo.&echo	0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.478629268.00000000068E0000.00000004.00000001.sdmp	false		high
https://www.bestchange.com	yVn2ywuhEC.exe, 00000008.00000000.304380149.0000000140087000.00000008.00020000.sdmp	false		high
http://www.kymoto.orgsQ	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://btinstall-artifacts.bittorrent.com/helper_ui/helper_ui.btinstall	0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false		high
http://www.haysoft.org%1-k	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://bt4.t-ru.org/ann	uTorrent.exe	false		high
http://www.symauth.com/rpa00	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false		high
https://www.limetorrents.info/search/	uTorrent.exe	false	Avira URL Cloud: safe	unknown
https://speed-staging.trontv.com	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false		high
https://btdig.com/search?q=	uTorrent.exe	false		high
https://www.bittorrent.com/legal/terms-of-use	0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false		high
https://www.bittorrent.com/legal/privacy/	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false		high
http://btinstall-artifacts.bittorrent.com/helper/helper.btinstall	0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp, uTorrent.exe	false		high
http://ocsp.entrust.net03	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.entrust.net02	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.kymoto.orgInformazioni	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495620775.0000000002182000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.473006101.0000000002203000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	yVn2ywuhEC.exe, 00000000.00000000.239895376.0000000140087000.00000008.00020000.sdmp, 3yYh0IvfZPkSsqrl.exe, 00000001.00000000.267070002.0000000000401000.00000020.00020000.sdmp, yVn2ywuhEC.exe, 00000002.00000000.269817660.0000000140087000.00000008.00020000.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000000.297092023.0000000000401000.00000020.00020000.sdmp, yVn2ywuhEC.exe, 00000008.00000000.304380149.0000000140087000.00000008.00020000.sdmp, PHO27fVEZKCoh9MD.exe, 00000010.00000000.388906847.0000000000401000.00000020.00020000.sdmp	false		high
https://media.adaware.com/torrentscanner/lp/search.php?p=bt&q=	uTorrent.exe	false		high
https://demonoid.is/files/?category=0&subcategory=0&quality=	uTorrent.exe	false	Avira URL Cloud: safe	unknown
http://www.kymoto.orgOm	0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.torlock.com/all/torrents/%s.html	uTorrent.exe	false		high
https://www.limetorrents.info/search/al	uTorrent.exe	false	Avira URL Cloud: safe	unknown
http://www.bittorrent.com0	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://crashserver.bittorrent.com/uploadbt_con.socket_error	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false		high
http://counter-strike.com.ua/	3yYh0IvfZPkSsqrl.exe, 00000001.00000003.495601373.00000000026FA000.00000004.00000001.sdmp, 3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.470573498.0000000003443000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.exe, 00000006.00000003.298056302.00000000023A0000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.673861987.0000000003593000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://speed.btt.network	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bittorrent.com/legal/privacy	0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false		high
https://zooqle.com/search?q=	uTorrent.exe	false		high
http://crl.entrust.net/ts1ca.crl0	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false		high
https://helper-catcher.bt.co/data/event-catcher-streamwidtdrawaldepositpendingcompletefailed	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false		high
https://github.com/netty/netty/issues/6520.s	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false		high
https://speed-staging.btt.network	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://demonoid.is/files/?category=0&subcategory=0&quality=0&seeded=2&seeded=2&query=	uTorrent.exe	false	Avira URL Cloud: safe	unknown
https://utclient.utorrent.com/client-user-onboarding/second-entry-index.html	uTorrent.exe	false		high
https://speed-dev.trontv.comhttps://speed-staging.trontv.comhttps://speed.trontv.comenvtokenstatussp	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.458527876.000000000705E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://1337x.to/search/%s/1/	uTorrent.exe	false		high
https://github.com/netty/netty/issues/6520.	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.486584207.000000000882E000.00000004.00000001.sdmp	false		high
http://aia.entrust.net/ts1-chain256.cer01	3yYh0IvfZPkSsqrl.tmp, 00000005.00000003.454276597.0000000005C5E000.00000004.00000001.sdmp, 0i1CtyGdkmLhJnVs.tmp, 0000000D.00000003.479438192.000000000742E000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
149.255.29.135	unknown	Russian Federation	48176	OOOSET-ASRU	false
94.251.128.6	unknown	Poland	21021	MULTIMEDIA-ASCableDTVInternetVoiceProviderinPoland	false
13.226.169.10	unknown	United States	16509	AMAZON-02US	false
112.168.71.78	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
134.249.127.48	unknown	Ukraine	15895	KSNET-ASUA	false
180.245.10.11	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	false
193.77.69.5	unknown	Slovenia	5603	SIOL-NETTelekomSlovenijeddSI	false
185.14.28.165	unknown	Ukraine	21100	ITLDC-NLUA	false
86.92.71.126	unknown	Netherlands	1136	KPNKPNNationalEU	false
54.194.137.170	unknown	United States	16509	AMAZON-02US	false
54.197.251.114	unknown	United States	14618	AMAZON-AESUS	false
3.211.230.23	unknown	United States	14618	AMAZON-AESUS	false
5.9.67.240	unknown	Germany	24940	HETZNER-ASDE	false
82.221.103.244	unknown	Iceland	50613	THORDC-ASIS	false
121.45.79.34	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	false
47.92.124.237	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
67.167.124.173	unknown	United States	7922	COMCAST-7922US	false
54.39.2.195	unknown	Canada	16276	OVHFR	false
50.17.220.153	unknown	United States	14618	AMAZON-AESUS	false
91.103.78.235	unknown	Russian Federation	24689	ROSINTEL-ASRU	false
13.226.169.4	unknown	United States	16509	AMAZON-02US	false
49.34.70.36	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
113.69.119.93	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
176.63.21.208	unknown	Hungary	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
2.135.114.157	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
92.240.51.15	unknown	Bosnia and Herzegowina	20875	HPTNET-ASBA	false
62.205.202.181	unknown	Latvia	28843	DAUTKOM-ASTheSIADauTKomTVservecustomersofcablenetwo	false
178.140.10.27	unknown	Russian Federation	42610	NCNET-ASRU	false
37.79.91.224	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
54.243.113.215	unknown	United States	14618	AMAZON-AESUS	false
27.57.254.186	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
189.250.0.174	unknown	Mexico	8151	UninetSAdeCVMX	false
102.142.65.153	unknown	Gabon	36924	GVA-CanalboxBJ	false
79.44.24.80	unknown	Italy	3269	ASN-IBSNAZIT	false
94.190.193.153	unknown	Bulgaria	12796	TCV-ASBG	false
176.63.24.100	unknown	Hungary	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
52.8.36.62	unknown	United States	16509	AMAZON-02US	false
94.36.132.239	unknown	Italy	8612	TISCALI-IT	false
206.188.117.12	unknown	Canada	46280	GOBCN-1CA	false
42.111.6.220	unknown	India	38266	VODAFONE-INVodafoneIndiaLtdIN	false
119.8.127.135	unknown	Singapore	136907	HWCLOUDS-AS-APHUAWEICLOUDSHK	false
69.119.127.215	unknown	United States	6128	CABLE-NET-1US	false
208.110.106.75	unknown	Canada	25668	CIPHERKEYCA	false
213.136.79.7	unknown	Germany	51167	CONTABODE	false
110.87.72.111	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
77.70.30.189	unknown	Bulgaria	35141	MEGALANBG	false
47.55.190.78	unknown	Canada	855	CANET-ASN-4CA	false
78.182.153.125	unknown	Turkey	9121	TTNETTR	false
38.121.71.145	unknown	United States	174	COGENT-174US	false
79.140.26.93	unknown	Russian Federation	41704	OGS-ASRU	false
87.92.146.184	unknown	Finland	16086	DNAFI	false
126.142.30.153	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
212.32.243.15	unknown	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
176.65.116.74	unknown	Russian Federation	13055	CSVLG-ASRU	false
118.14.200.58	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
183.167.31.157	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
173.172.64.220	unknown	United States	11427	TWC-11427-TEXASUS	false
89.64.54.152	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
185.165.160.176	unknown	Russian Federation	62423	TCENTER-ASRU	false
173.254.195.58	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	false
80.251.153.186	unknown	Russian Federation	38972	INTERSAT-ASRU	false
95.87.199.169	unknown	Bulgaria	43561	NET1-ASBG	false
198.12.121.229	unknown	United States	36352	AS-COLOCROSSINGUS	false
188.242.61.133	unknown	Russian Federation	35807	SKYNET-SPB-ASRU	false
104.16.236.79	unknown	United States	13335	CLOUDFLARENETUS	false
59.97.170.49	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
210.6.117.216	unknown	Hong Kong	9269	HKBN-AS-APHongKongBroadbandNetworkLtdHK	false
161.230.30.190	unknown	Portugal	12353	VODAFONE-PTVodafonePortugalPT	false
18.218.241.3	unknown	United States	16509	AMAZON-02US	false
89.240.209.7	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
67.215.246.203	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	false
212.46.18.149	unknown	Russian Federation	8752	ASVT-NETWORKRussiaRU	false
188.138.137.196	unknown	Moldova Republic of	31252	STARNET-ASMD	false
195.38.11.55	unknown	Ukraine	43312	I-LAN-ASUA	false
18.223.137.220	unknown	United States	16509	AMAZON-02US	false
121.237.191.0	unknown	China	137702	CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince	false
98.115.85.132	unknown	United States	701	UUNETUS	false
178.79.242.147	unknown	European Union	22822	LLNWUS	false
88.90.139.39	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
1.164.146.117	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
84.107.14.129	unknown	Netherlands	33915	TNF-ASNL	false
67.215.246.10	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	false
92.249.157.115	unknown	Hungary	20845	DIGICABLEHU	false
13.58.27.33	unknown	United States	16509	AMAZON-02US	false
178.79.242.16	unknown	European Union	22822	LLNWUS	false
2.61.72.86	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
107.22.221.32	unknown	United States	14618	AMAZON-AESUS	false
13.226.169.41	unknown	United States	16509	AMAZON-02US	false
161.97.90.50	unknown	United States	51167	CONTABODE	false
84.17.52.74	unknown	United Kingdom	60068	CDN77GB	false
208.96.115.15	unknown	Canada	23184	PERSONACA	false
188.163.58.192	unknown	Ukraine	15895	KSNET-ASUA	false
81.183.59.95	unknown	Hungary	5483	MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU	false
217.65.108.62	unknown	Hungary	5483	MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU	false
219.79.117.83	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	false

Private

IP
192.168.2.1
192.168.2.3

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	346304
Start date:	30.01.2021
Start time:	12:47:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 19m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	yVn2ywuhEC.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Cmdline fuzzy
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal40.rans.adwa.evad.winEXE@48/93@94/98
EGA Information:	Failed
HDC Information:	Successful, ratio: 21.1% (good quality ratio 18.1%) Quality average: 73.8% Quality standard deviation: 34.9%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 40.88.32.150, 104.42.151.234, 23.210.248.85, 8.248.133.254, 8.248.125.254, 67.27.157.126, 67.26.81.254, 67.27.157.254, 88.221.62.148, 172.217.17.74, 23.211.5.34, 172.217.20.74, 172.217.17.46, 172.217.17.67, 172.217.17.40, 23.210.249.164, 2.20.18.66, 2.19.78.85, 209.197.3.24, 152.199.19.161 Excluded domains from analysis (whitelisted): gstaticadssl.l.google.com, cds.s5x3j6q5.hwcdn.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e5048.dsca.akamaiedge.net, e6640.x.akamaiedge.net, ssum.casalemedia.com.edgekey.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, skypedataprdcoleus15.cloudapp.net, cdn.optimizely.com.edgekey.net, go.microsoft.com, e8037.g.akamaiedge.net, www.googletagmanager.com, audownload.windowsupdate.nsatc.net, 2-01-275d-0018.cdx.cedexis.net, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.google-analytics.com, fonts.googleapis.com, fs.microsoft.com, www-google-analytics.l.google.com, ajax.googleapis.com, fonts.gstatic.com, ie9comview.vo.msecnd.net, www-googletagmanager.l.google.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, e4343.x.akamaiedge.net, wildcard.cdn.optimizely.com.edgekey.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, cdn.o6.edgekey.net, skypedataprdcolwus16.cloudapp.net, cs9.wpc.v0cdn.net Report creation exceeded maximum time and may have missing behavior and disassembly information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Too many dropped files, some of them have not been restored

Simulations

Behavior and APIs

Time	Type	Description
12:48:28	API Interceptor	3x Sleep call for process: yVn2ywuhEC.exe modified
12:50:02	API Interceptor	11x Sleep call for process: uTorrent.exe modified
12:50:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run uTorrent "C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
12:51:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run uTorrent "C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
82.221.103.244	uTorrent.exe	Get hash	malicious	Browse
	new.exe	Get hash	malicious	Browse
	3.4.2 build 37754.exe	Get hash	malicious	Browse
	.i	Get hash	malicious	Browse
	QsCC5s5NrR.exe	Get hash	malicious	Browse
	EBookCodec.exe	Get hash	malicious	Browse
47.92.124.237	http://dl.acestream.org/Ace_Stream_Media_3.1.32.exe	Get hash	malicious	Browse
239.255.255.250	VM859-7757.htm	Get hash	malicious	Browse
	PDF_hsohanpal@towerxchange.comMessage.html	Get hash	malicious	Browse
	ID4380.htm	Get hash	malicious	Browse
	DHL-INVOICE RECEIPT.html	Get hash	malicious	Browse
	Tebling_Resortsac_FILE-HP38XM.htm	Get hash	malicious	Browse
	67654565677.htmL	Get hash	malicious	Browse
	testMalware3.ps1	Get hash	malicious	Browse
	Vivaldi.3.5.2115.87.x64.exe	Get hash	malicious	Browse
	Cherokeebrick Progress billing(malware).html	Get hash	malicious	Browse
	fe89833d-6e0a-4916-929d-81ffbd4a244e_ORDER54#0.html	Get hash	malicious	Browse
	Maersk_BL Draft_copy_Shipping_documents.html	Get hash	malicious	Browse
	4892.htm	Get hash	malicious	Browse
	4892.htm	Get hash	malicious	Browse
	Release Pending messages on account.html	Get hash	malicious	Browse
	kkToaAZ6Mm.exe	Get hash	malicious	Browse
	ACH PAYMENT REMITTANCE ADVICE.xlsx	Get hash	malicious	Browse
	Notice_Admin_Johnstoncompanies_8578.htm	Get hash	malicious	Browse
	ACH WIRE PAYMENT ADVICE..xlsx	Get hash	malicious	Browse
	1.html	Get hash	malicious	Browse
	http://down10d.zol.com.cn/zoldownload/fangsong_GB231 2@81_432727.exe	Get hash	malicious	Browse
54.194.137.170	uTorrent.exe	Get hash	malicious	Browse
13.226.169.10	http://club.chicacircle.com	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
s.twitter.com	33ffr.dll	Get hash	malicious	Browse	104.244.42.131
	sample4.exe	Get hash	malicious	Browse	104.244.42.131
	http://search.hwatchtvnow.co	Get hash	malicious	Browse	104.244.42.131
	http://search.hshipmenttracker.co	Get hash	malicious	Browse	104.244.42.67
	https://t.yesware.com/tt/ae9851ab7b578dad1289f08bbf450624f7ae3a45/2ee42987f58d2f32bb36ff11a00dd921/2f4e7e35c28c3b7f4958904f5584a915/joom.ag/2VFC	Get hash	malicious	Browse	104.244.42.195
	https://joom.ag/3wFC	Get hash	malicious	Browse	104.244.42.3
utorrent.com	bin.sh	Get hash	malicious	Browse	82.221.103.244
	i	Get hash	malicious	Browse	82.221.103.244
	Mozi.m	Get hash	malicious	Browse	82.221.103.244
	Photo.exe	Get hash	malicious	Browse	82.221.103.244
	BitTorrent.exe	Get hash	malicious	Browse	82.221.103.244
	new.exe	Get hash	malicious	Browse	82.221.103.244
	uTorrent.exe	Get hash	malicious	Browse	82.221.103.244
	download.ap.bittorrent.com/track/stable/endpoint/utorrent/os/windows	Get hash	malicious	Browse	13.32.163.232
	.i	Get hash	malicious	Browse	82.221.103.244
stats.l.doubleclick.net	VM859-7757.htm	Get hash	malicious	Browse	108.177.127.157
	Acunetix Premium v13.0.201112128 Activation Tool.exe	Get hash	malicious	Browse	74.125.133.157
	Jasper-6.10.0.docx	Get hash	malicious	Browse	74.125.140.157
	e-card.htm .exe	Get hash	malicious	Browse	108.177.15.154
	e-card.jpg .exe	Get hash	malicious	Browse	108.177.15.154
	https://new-fax-messages.mydopweb.com/	Get hash	malicious	Browse	108.177.15.156
	https://ozmmdmfly0ob6rsgyfcjja-on.drv.tw/GAlAFw&flowName=GlifWebSignIn&flowEntry=AddSession&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties=7I5fOQe2aVADfQrM2gnSPpnNXdJDFVEswOkTEzvRpizt0MxezF-fEHwkij9KPoULqpUnkx2n_0Dud0uKVG57peviUxksCdnZyX7ab0n1hx9UpfkPdjMq2wNzHOC_K3ig&nonce=636810071538546755.OTdjZTIwMDItYjU4Yy00ODAxLTkzMDgtMzAzNGIwNThmY2ZkZWI3OTkzNDUtN2NlZC00MDIxLWFlZDQtNzhkNmM0ODhmMzAz&/	Get hash	malicious	Browse	108.177.15.155
	https://web.tresorit.com/l/JG7xl#7YqXRnhV6spRT3ekJskNaw	Get hash	malicious	Browse	108.177.15.157
	http://search.hwatchtvnow.co	Get hash	malicious	Browse	108.177.15.155
	https://wfuwdbjwquoiynfb-dot-tundasma.el.r.appspot.com/#test@test.com	Get hash	malicious	Browse	108.177.15.156
	http://bit.ly/3nlGvk0	Get hash	malicious	Browse	74.125.140.156
	https://cypressbayhockey.com/NO	Get hash	malicious	Browse	74.125.140.156
	https://pdfsharedmessage.xtensio.com/7wtcdlta	Get hash	malicious	Browse	74.125.140.154
	https://viewer.desygner.com/-M7QpDHAe3Y/	Get hash	malicious	Browse	74.125.140.157
	https://alijafari6.wixsite.com/owa-projection-aspx	Get hash	malicious	Browse	74.125.140.154
	details.html	Get hash	malicious	Browse	74.125.140.154
	https://web.tresorit.com/l/d2q5C#T3PZC5SR6Y1Akp1-8AT_Jg	Get hash	malicious	Browse	74.125.140.157
	https://web.tresorit.com/l/d2q5C#T3PZC5SR6Y1Akp1-8AT_Jg	Get hash	malicious	Browse	74.125.140.154
	https://nimb.ws/10IXxl	Get hash	malicious	Browse	74.125.140.156
	https://www.canva.com/design/DAESYWKuLHs/avvDNRvDuj_tk82H9Q45ZQ/view?utm_content=DAESYWKuLHs&utm_campaign=designshare&utm_medium=link&utm_source=sharebutton	Get hash	malicious	Browse	74.125.140.157

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
KIXS-AS-KRKoreaTelecomKR	Xe63YxZMDK.dll	Get hash	malicious	Browse	175.207.13.56
	UGPK60taH6.dll	Get hash	malicious	Browse	175.207.13.56
	printouts of outstanding as of Jan_27_2021.xlsm	Get hash	malicious	Browse	175.207.13.56
	Statement as of 27_Jan_2021.xlsm	Get hash	malicious	Browse	175.207.13.56
	Statement of Account as of 27_Jan_2021.xlsm	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.ArtemisTrojan.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.ArtemisB048EE8597AB.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.BScope.Trojan.Ursnif.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.ArtemisC99E19FA694E.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.BScope.Trojan.Ursnif.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.BScope.Trojan.Ursnif.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.BScope.Trojan.Ursnif.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.BScope.Trojan.Ursnif.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.BScope.Trojan.Ursnif.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.BScope.Trojan.Ursnif.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.BScope.Trojan.Ursnif.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.Artemis4BCFDC52324B.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.ArtemisA1874DDB2790.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.ArtemisF00BCCFBF4BA.dll	Get hash	malicious	Browse	175.207.13.56
	SecuriteInfo.com.Generic.mg.f4e794908d8d8093.dll	Get hash	malicious	Browse	175.207.13.56
AMAZON-02US	KYC AGREEMENT.xlsx	Get hash	malicious	Browse	3.124.3.141
	ki7710921.exe	Get hash	malicious	Browse	3.140.151.209
	Signature 02.xlsx	Get hash	malicious	Browse	18.194.54.219
	Product and Specifications.xlsx	Get hash	malicious	Browse	34.220.241.170
	Agreement02.xlsx	Get hash	malicious	Browse	18.194.54.219
	c8TrAKsz0T.exe	Get hash	malicious	Browse	52.58.78.16
	ezr37taArt.exe	Get hash	malicious	Browse	44.227.76.166
	lbqFKoALqe.exe	Get hash	malicious	Browse	75.2.124.199
	eDpjcIIh9G.exe	Get hash	malicious	Browse	13.248.196.204
	6tivtkKtQx.exe	Get hash	malicious	Browse	52.58.78.16
	wYpMWI3N52.exe	Get hash	malicious	Browse	3.20.233.143
	CMA CGM Shipping Documents COAU7014424560.xlsx	Get hash	malicious	Browse	3.131.104.217
	INV-FACTUUR00921.xlsx	Get hash	malicious	Browse	52.219.56.107
	INV-FACTUUR00921.xlsx	Get hash	malicious	Browse	52.219.56.91
	Career-Question.doc	Get hash	malicious	Browse	54.219.108.207
	Career-Question.doc	Get hash	malicious	Browse	54.219.108.207
	Career-Question.doc	Get hash	malicious	Browse	54.219.108.207
	RA test.docx	Get hash	malicious	Browse	143.204.2.12
	RA test.docx	Get hash	malicious	Browse	143.204.2.94
	Statement for January 2021.exe	Get hash	malicious	Browse	76.76.21.21
MULTIMEDIA-ASCableDTVInternetVoiceProviderinPoland	malware1.exe	Get hash	malicious	Browse	94.251.219.92
	vrhiyc.exe	Get hash	malicious	Browse	81.190.94.112
	ucrcdh.exe	Get hash	malicious	Browse	81.190.94.112
	lrbwh.exe	Get hash	malicious	Browse	81.190.94.112
	bot.-7-15.arm7	Get hash	malicious	Browse	89.228.145.44
	68Faktura_VAT_8263562736.js	Get hash	malicious	Browse	62.141.244.144
	41Faktura_VAT_62738911092.js	Get hash	malicious	Browse	89.17.225.163
	41Faktura_VAT_62738911092.js	Get hash	malicious	Browse	89.17.225.163
	47Faktura_VAT_73564529870.js	Get hash	malicious	Browse	62.141.244.144
	45Faktura_VAT_74656384765.js	Get hash	malicious	Browse	89.17.225.163
	41Faktura_VAT_24563527765.js	Get hash	malicious	Browse	62.141.244.144
	invoice.doc	Get hash	malicious	Browse	62.141.244.144
	http://emailmarketing.richtraining.com.au/t/j-l-phuaut-jhfhtuijh-y/	Get hash	malicious	Browse	62.141.244.144
	003-.doc	Get hash	malicious	Browse	62.141.244.144
	003-.doc	Get hash	malicious	Browse	89.17.225.163
	HkbqizQ3O5.exe	Get hash	malicious	Browse	89.228.34.247
	33Messag.exe	Get hash	malicious	Browse	89.230.178.103
	02939-100-0102-.vbs	Get hash	malicious	Browse	62.141.241.11

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
9e10692f1b7f78228b2d4e424db3a98c	ORDEN.exe	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	Customer@Volt.com.htm	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	VM859-7757.htm	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	VM859-7757.htm	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	Require_Quote_20200128 SSG.pdf ind.exe	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	UGPK60taH6.dll	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	VolP-Byungil.lim.HTM	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	usd2.dll	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	Tracy Scott shared Intakes with you.html	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	RA test.docx	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	#Ud83d#Udce9.htm	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	595989.dll	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	PAIEMENT-PDF90021.xlsx	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	Final_Notification.docx	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	SecuriteInfo.com.ArtemisF00BCCFBF4BA.dll	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	SecuriteInfo.com.Generic.mg.f4e794908d8d8093.dll	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	SecuriteInfo.com.Artemis2EB570BBBAA8.dll	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	#B30COPY.htm	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	33ffr.dll	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
	SecuriteInfo.com.ArtemisCAA9F750565C.dll	Get hash	malicious	Browse	91.228.74.189 108.177.127.155 104.244.42.69 178.79.242.16 31.13.92.14 54.197.251.114 13.226.169.128 104.244.42.131 13.226.169.14 99.86.154.93 3.214.78.220 151.101.12.157 54.208.194.17
6271f898ce5be7dd52b0fc260d0662b3	rufus-3.11.exe	Get hash	malicious	Browse	54.197.251.114 99.86.154.93 185.86.137.113 178.79.242.16
	filecoach[1].exe	Get hash	malicious	Browse	54.197.251.114 99.86.154.93 185.86.137.113 178.79.242.16
	Invoice_no.-9fwd7-xy0c5zge.pdf	Get hash	malicious	Browse	54.197.251.114 99.86.154.93 185.86.137.113 178.79.242.16
	Invoice_no.-9fwd7-xy0c5zge.pdf	Get hash	malicious	Browse	54.197.251.114 99.86.154.93 185.86.137.113 178.79.242.16
	Incoming_Fax-Kknsy vkomlus2.pdf	Get hash	malicious	Browse	54.197.251.114 99.86.154.93 185.86.137.113 178.79.242.16
	New Fax 8elrb bq7txtl4.pdf	Get hash	malicious	Browse	54.197.251.114 99.86.154.93 185.86.137.113 178.79.242.16
	https://val.filesconverterpro.com/js/FilesConverterProApp.exe	Get hash	malicious	Browse	54.197.251.114 99.86.154.93 185.86.137.113 178.79.242.16
3b5074b1b5d032e5620f69f9f700ff0e	bLupWqls5l.exe	Get hash	malicious	Browse	104.16.236.79
	Payment Receipt.exe	Get hash	malicious	Browse	104.16.236.79
	UQtGj1Yzlf.exe	Get hash	malicious	Browse	104.16.236.79
	INV-FACTUUR00921.xlsx	Get hash	malicious	Browse	104.16.236.79
	6729001591617.exe	Get hash	malicious	Browse	104.16.236.79
	tQdHht8Bwc.exe	Get hash	malicious	Browse	104.16.236.79
	SecuriteInfo.com.Trojan.PackedNET.471.11170.exe	Get hash	malicious	Browse	104.16.236.79
	ttrpym.exe	Get hash	malicious	Browse	104.16.236.79
	roboforex4multisetup.exe	Get hash	malicious	Browse	104.16.236.79
	MV TAN BINH 135.pdf.exe	Get hash	malicious	Browse	104.16.236.79
	SecuriteInfo.com.Variant.Zusy.363976.7571.exe	Get hash	malicious	Browse	104.16.236.79
	SecuriteInfo.com.Trojan.PackedNET.519.21836.exe	Get hash	malicious	Browse	104.16.236.79
	RFQ RPM202011-776JD.jpg.lnk	Get hash	malicious	Browse	104.16.236.79
	8Aobnx1VRi.exe	Get hash	malicious	Browse	104.16.236.79
	RFQ-Strip Casting Line.exe	Get hash	malicious	Browse	104.16.236.79
	NEW ORDER PO 20200909.exe	Get hash	malicious	Browse	104.16.236.79
	U1G3qA2l4I.exe	Get hash	malicious	Browse	104.16.236.79
	file.exe	Get hash	malicious	Browse	104.16.236.79
	file.exe	Get hash	malicious	Browse	104.16.236.79
	Updated Invoice{swift..exe	Get hash	malicious	Browse	104.16.236.79

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\is-50A2H.tmp\_isetup\_setup64.tmp	FrC4UAhnvX.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.DownLoader36.34557.26355.exe	Get hash	malicious	Browse
	9oUx9PzdSA.exe	Get hash	malicious	Browse
	atikmdag-patcher 1.4.7.exe	Get hash	malicious	Browse
	Atikmdag Patcher 1.4.8.sfx.exe	Get hash	malicious	Browse
	atikmdag-patcher 1.4.7.sfx.exe	Get hash	malicious	Browse
	VoiceMan Reflex-Setup-V3.0.3.exe	Get hash	malicious	Browse
	FastKeys_Setup.exe	Get hash	malicious	Browse
	FastKeys_Setup.exe	Get hash	malicious	Browse
	atiflash_293.sfx.exe	Get hash	malicious	Browse
	sfk_setup.exe	Get hash	malicious	Browse
	atiflash_293.exe	Get hash	malicious	Browse
	Softerra Adaxes 2011.3.exe	Get hash	malicious	Browse
	atikmdag-patcher 1.4.8.exe	Get hash	malicious	Browse
	atikmdag-patcher_1.4.8.exe	Get hash	malicious	Browse
	OhGodAnETHlargementPill2.exe	Get hash	malicious	Browse
	atikmdag-patcher-1.4.8.exe	Get hash	malicious	Browse
	atiflash_293.exe	Get hash	malicious	Browse
	OhGodAnETHlargementPill.sfx.exe	Get hash	malicious	Browse
	godflex-r2.exe	Get hash	malicious	Browse

Created / dropped Files

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	30592204
Entropy (8bit):	7.999886692597542
Encrypted:	true
SSDEEP:	786432:AhfOHP8OSSRxjRJrf5dE/q3bZPYJeY8kKDjf0y3hGUx2eM:AhfOHPCSRBRLoUZQEkKXf0y3hdx2eM
MD5:	5F0385CB415C500F7B46433D62E7DC22
SHA1:	2AB3B5679CDB1FA7C4896D60A0C8C253C7CB5B54
SHA-256:	73DAA135418CF66B0D3567E05B2F6187859734743BEAEDB264F6D5C2327C1BD2
SHA-512:	4D0CE781E373D82E969CD89CBC918B3430639EC18DDFB6FB7A2C078147B740040A3790E7A53363E9AFC02B6FD0DDB6F507BB8AC1F9D4EC0810653D071A2FCAC1
Malicious:	true
Preview:	.....B....].........+.>.j.p....L.qj.x..Ql/..u..E. ..K. ..bJ...`.F..t....f.a......NO........c....( e....G.....;.B.t[.\.V...E.-J1.......!..K...TV.......1j.E....j..,<....X..K..mA.']w .......X...kV.&E.....87.e$.w..-..i....)t...cu.mmH{.. ..U.8...K....3...lz.....K.~.$9.q....c.k.,.<..../@..b.B.t...]2~Qg;T.....s......%............BK8.H.....u.[..oD<.b.R .vj.8>.Y...\|.1MX...<.,....Z.-Nm....Y..i.5.!?..hgVBC.H...&.6."W._r&,.....8]..p...?C/.LE....../..".:9.l........"...3y.j^x<[.1MvA...e.q`.+.F{..pBfc.^.olcZ..a....m\|.)...u@.%M..L!M.Y..G......S.R..jn.'.&.-.Ch..]./...H.)%....L.0......,..M:..h....t.UVp...f.$..".x...4'9>.P..a.".z/+.b.f..q6..B.!LbN..m..[..6.>)\w..@!.:..-F(.2^....S..".......r.L.3e..{...n.A6./;.sx.k..r..(`....W.S.....u.J#.JxpIb.b`\....../.`.S...M>..]..."..o...3.b......GP`.^.8%.....AM..}.-..HM.G[.?oi....M.c..oW..)rHw<..6xZ...Q..T..%...eu.y8L.C..h....).>.@WB..5-......o....s...<.zP.aK....G..v...+..%.{...L.&5.r...:..v..W..9....~P...Cj...l..r.+....

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	30592220
Entropy (8bit):	7.999886413002832
Encrypted:	true
SSDEEP:	786432:gIhmHP8OSSRxjRJrf5dE/q3bZPYJeY8kKDjf0y3hGUx2eM:ghHPCSRBRLoUZQEkKXf0y3hdx2eM
MD5:	3B4B9D589C24375CA68B5FEC09FFDFCE
SHA1:	FBB365BC2332AADC008D3737EC29D60B03BF33F4
SHA-256:	CFB3F79B919F88103B73BC1B93F1227C2050897D835D89E2E3D368B765A7B4F5
SHA-512:	31203DB8E0EFDD25EBB67764F53FED55ACFE30C6FAA18F8B912EFD27D7AB027D90B98CDEC65925A40C6615F4D06A257FE25CA5E9F5C186D73845F38CD9ED9384
Malicious:	true
Preview:	.....+..3.Y....n%..L.S.'"za.=v+....\.....J..F.o,..<.6..3.w1...p..)llE.....N...=`.p..l../...+/RX.\\..n,.2..x.&...F..JB..dy..JI.....J...m....EK....N..}.....R..p...&...}..X..\|..@.s.b..../.T..4A.J..JnhT.p....4..}.{D....<..6.G...f.Wd..0[......Q..M>l..._-s.$..k...9..e.A...G....G....f.).Rn..w.V..6..Cy..;Q.7m...;6?D.E.qk.$....2.~.kjK......%\|.......?.....n.I.:.j{=..5W..U.......,..m..Ej`..N.........Q.=..J.).~..q.w#A.S....G..M....{w.Y.$%B.._.CO.j%...(..oT.>.6l...um=B...........r...ZV.d..X.'.....f$..D......?B......f...a......e....lV.m.c..u@....M[..{!Ia-f.\|"..+...rN...........;5..EX....O..<!P..4..c@<.d.x6ly.._N....b..c...mliv..D\....k..o...7CU....`Xl.(S/.7]7.8^S.h.4../..G..;Q..~...n....Q4O:........R.....!.v=L.].....:.."Vz...O..&.f..PF._.A..S....pl.)...x6....f.<...ra...[..o....>.Z].6t8.&...v.O.J.....n8(.0.#.N&.,..}........#...W.....f.;.......Xek.Y.......L.G...x\D#..VK.l..<.... .g.=f.B.W..Z..v........ .........6K...V..&H.U2.L....K-..[-SUY.

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.vovalex.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	30592236
Entropy (8bit):	7.999886659266582
Encrypted:	true
SSDEEP:	786432:onrHP8OSSRxjRJrf5dE/q3bZPYJeY8kKDjf0y3hGUx2eM:onrHPCSRBRLoUZQEkKXf0y3hdx2eM
MD5:	8066B151B8689E7D9F1C50B2C68F220E
SHA1:	1C1E2D075A325865729535484312D666EDE3D34A
SHA-256:	E3A94E504E014F692B617D9B624988AA7F1E9B2F7B28AAF0D5B3A61284C8B635
SHA-512:	CA41D574A49C7E464BE4B0FE22BA144A6E77631940C180B9D31B15CAE932156CBF050B36EA43221FF2104CE57B854D302A5F40D08FC748BD3B24686B9DE59A1A
Malicious:	true
Preview:	N..Q../Y_..5.!..........o.^.c......u......a....7...,w...>.JSH.Po..C...IKyU.....PC M..........[4.../Fb.Y'89.3..!..4r$9Zxy..^-....&..".........`........7..I...x.[...X...X....k)...v.Nn...6>.....Z...m...P . n.".......n.D..$`o...X.....u1....=...\|.Y'p.jkmyM.1.e..F....dJ....K....uZ......J..]..].G...C..n.G....e..s...I.@..N...y.A.F..D.y...>...Q/Kd.+c..K.....&..........O.9...0..o.e..,...{E..\|e..}......f..l..P.#`.N......n..R.9.-.......gJ{a.......{X.nP"?b..(.;...i.W.Ebn...L..o...CvpAq..6.j...s.b..H........w.2...Y.jA.".c..53..>....Sh....d.p...i...2...@g...a..NOU?.;..@.8/...Ft/.[^...%...}I.Oj...Tca....a...NA.M..PNz..a@..}$..Z..8..j.m.u...Rt.;[...g..-..#../.Z3-....\|...t8<.X..`a..k._.r..'....a.N..D......G.E4....;".;...j/]...d..&.......z."..A<j&"...z@Y...(.[...4..zo.....~.4.-.....~..'....6.bvY.........'[...x.r...H2p.z%&.L{...Q..o8.LF..e..7A.......'...E^...e...........M.a......C....H..T....V...A\|\|k......T3.U4.BA(....).pL... )&..Q..L........1MACQ.

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	3944464
Entropy (8bit):	6.968153098019576
Encrypted:	false
SSDEEP:	49152:OIjC61txnA7Bj/3l81gfzbsIvTmsUsB8nXKpP2KTKL8I7AhQQTwgRU5:xGkzwjfl8eEqUlXKdQs
MD5:	9B5D3D52AA3031906F687E4EF931C0E0
SHA1:	46F670040B04F53D5ECBC7834C2B94979AC18C26
SHA-256:	0D4F9C44CCAE68F27F7057A8A3E8319232E3824B0B6198F7B55F59D24D96D259
SHA-512:	52E0565971815DEC80A10D18588EA1D35817DA54AF35062D6130ADE8E4C539E972177014B2282DDEBFA4BD6FC394B0C5EA3A0F71064DD2BE1D66120366B766E7
Malicious:	false
Preview:	..6+......w..R..P.'..\|..w........a..Fs.....Z..1.{G..4...\|..,...D^...n...+.N...r...t.:...5...w.o`'...?..... ..s..(U...c...<5@..].,.;M.. .F.vk#.....]..t..5.....$C. j.;..m!.IR.Y...Y...[S.....Xy.....9...Y\1K.m.0....=...r...nw.c..f.W..AE..=.........Z.I..B...E?g.#+}.=i..#...,.X..4-z}.f..........}\..T...v.?1.Z...Eh.6(..~k...?..k..$M`&B...s}..%.O..%G.`.&.m.....{....[.w..K.t.&.\.a...th9[3'....p0=.A.V`.T;.T.)..z_c..N.+.FEO-+l}[R......i..I...ol.3P.....C.F.+..$.......p.M.;.E..:......xYU'X]....U...w..py..........&.b.g..F.A\.\|.Q...[Tf.>..{.z...C.....GK..........h.8K0.!.i..k..0Z]iQ.{..N.Y..u8....h.G..c...g..CM\|......%s.N...PG...64&.=...a6^(...T...R........f$...[Q+V.F8....')a.O...J..&........#$...v...[F.-....[....Y..N1A.G..Y.#...Zj........c..u.f4U..ll....P$_..zx.......H.O?....8.?..x..u..."..(.Q...<......0.......m..q_..........B...3..s..\|.\P...d.y......g.sjZ..s..B$.:.>.:..E...r....8..{s.8/..1r:.e..9.<..G...8"..j.......".."Gr.6..Km.s.C.;5Q.5b.

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	3944480
Entropy (8bit):	6.967923942252873
Encrypted:	false
SSDEEP:	49152:yPDCDfkR9urkwq3U/ALhfzbsIvTmsUsB8nXKpP2KTKL8I7AhQQTwgRU5:y7ufkRIRYEqUlXKdQs
MD5:	2DA403C9509787C0D252B1D4DFF09611
SHA1:	AA3975964067A6DC2AFE921AF51B936BEC3F7836
SHA-256:	3F78D52AD659BE65294EF8B8F02542211798A0E1D299D96C2AC82E047ED7D40A
SHA-512:	4BDF6D3DA972C8707271A864079388016D6DD3B4355B4A56C486828E4C422F9435B737A25B3F48310BC435ADD17BEB3ABB2BF2488D5F460550E8528FA7C3C360
Malicious:	false
Preview:	.......7]#/..0.H5G%....@=)....y.#.JK.bE.v1r.......~........B.K.....R...Oq...x...}8...1G.s....0~l...X.~2_./'...^W...6..X....b.GOL.1..6=...}.......06...w.n....h.M...y..4p.?.....t.G.....[.L...'.#....(3n:.9...CE.t.W..C.~.. ..;..S..c...Ub...E.-(;.].:rU...p.bM.Ol.8..t..M...y.......J.._.d.}~.c.....]..h.R.(O&.\F.....4....WVB..I...3...>"<n..IS3..q...d...V.....w..A...I.J...Dr..`./.t...d......~._V...`.__..4....p.Ze..w=......~.<..3o..tn5..U..t.dvb-...w..r..\..3C!..R.....]...5.........PtK0).S.\|.V.p.d....ujs1..VQ.-`..!B.`:a.................B%..8..K...".Nv...7............'r:..)......<....2...R...-..X...8.brIkpx...................)}w<...1.2._.4q}.......,@..l~.....t.b}...\I..R.D2Rv_w.1...s.>....(E.SZ..K.4.J..PdNK7n........[..b.!r.`...h.pj...M....N.#..9R{.qI.9+....Q..a.n.r...S.b.h...F)... 33.gk.\..o .$<..3....)U..*..p...9.o.^P.%.v.\|.'.....o.S......S.dd[.A.........&..n..0...Si..d.....u.b$.....g.p..a.0..#.{.#C.M.!L.......5%rw.......r,`......f

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.vovalex.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	3944496
Entropy (8bit):	6.9685785922492585
Encrypted:	false
SSDEEP:	49152:qfVk5F88h90hkqHgPSTvVGTXmCxffzbsIvTmsUsB8nXKpP2KTKL8I7AhQQTwgRU5:qWcIqkIgYNGZxfEqUlXKdQs
MD5:	77A4D89F20A22E8B93EDB94C1D6460D2
SHA1:	7EE8249765A756BCE2E1C4BB5EF57ACC5DF6D321
SHA-256:	66585C2C0BEAA5A8D09D4CA0C6F21C8BF5321B151273103FA4529ADB36552492
SHA-512:	7256CF9D8DCC7C47DE85BAF95568ECA60BD732D309295FB121AA3131FB1B20B6ED2981A4C7A6500D014CE27204D373730F176362EB49DEADD7FD5894A11551A4
Malicious:	false
Preview:	...a....f ......a...p...Z...B.0K.8{.H........W..7.=.$......k.j.....@..n....\/...P..0.y.C3..n...SH..H 4@..Y(..-.<...\|..5...4e..d.!eI+.S......4......\..\.fd.......8..Rh .(Hj..2....ct.j../a.0......2.T)..:...h..J..[.........A...+?6..YFt..........'9..E...t..g.,...M..AN....{..8..;..`...n..K.H.....R#.....9Joe.l[..2...B.4..p.$'<d. ..E..D...d.HED%.B.3.#.5.....:N...'....t...=.>.])..=..a.<......OL.%...8..&$(H.I..P2..g^P.]..@.~...,....5.S...:..g.8....o/:.t..u.{.H..E4UHf...>.z......$...s]OiY..S....@ .\A..9....M..6....gg.u..u..>?....p..B.f.V..){.X .r......U.]wu..Z..!oAb.".z........W..5<..W4`.Wo.......)\........J#Z.w.....`-k:]....r4.8;...X....p[....L.X]..t....M;C.......i[3.pM....f.....84..D.EH./...z..>...l.<.Y.I./......h]....{....^.....yLl.yO......]..IU....N...zM..]P.@Ss-.<7.\|8?....R.c`.8.$P....z....1._....}.,R...w....R..I\w<..wN &v.C...P[..R.&.~..?.."@.Qs\|xfDcSY.e.F..B.y-8......G.SZ....].L.\|.i....h(..-..P....'..L..w.e..H.....q.....r[.;..4rS......

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	5152
Entropy (8bit):	7.962982918746403
Encrypted:	false
SSDEEP:	96:On7SNGvlNwSj3jN/+TUa3wotCNG8VG+AQ1PHzKCz9TSs6WJoA:O5jcTUap/8VGnQ1vn9TV6WJb
MD5:	D04BFAB435902E4AE66E5143C4391863
SHA1:	F3999FEC549BE8FC7074A8D96FD9C8ACAF7016E7
SHA-256:	89DABF236DCE6132EA4DF53ACE35C61837D65567CAD37792FD7512B4B11DBC81
SHA-512:	9A4285FDCEC2E7CB992464912356FA561E16B693312DC42CB1749CCF714E9F87E3389676EF7DA6F4422AD67B63C0EA87A87E2498B671C65A099F952B990CC95E
Malicious:	false
Preview:	.Cv..WR......\|A.....\|n#W...bt....FU..E..1.(... .C.............W...8...8.,.#1(&."...8j..c...d.J.>te..iJu....p...3..?N.e>..o..j.r}..2b.Q..1.6.......Qt:...W}:]..a.%...S....3QC...a.y.T...G.m.%...m.{..-K..=D.5...D..ia!...P.n..\.)r....Q'....t.w........d.....GHn.......S.o..b.~b.._..X....D.4f.l....O/l.jn..$..@%...jFTh......\|......T#...........W.."9.........e\<.n!...V..>X.@..?.=....o..R.._.\.t...I.....c....:zV..w..47.r.R]e[...^...Q...2.e.,q ...gz...._.....#.o.V..k. .,......rv.SZ....m7.e.W'.]@8;.as.....ro@..K....8....g........\|<.F...@..N.J..L....A.....p.p....S....e_..Xh:}..g$0......n.......#...Z..w..N..."_)..a.X..<T..`......^.5- Nl....t...Ji...D.@....i2.*2..c..e.A.`..v..Lu.9.J.gN....U.`..vr.n...+......I.......F...(owW.......aZ.../2..EPBM.d....4.y.t.X...L.......K1......-.....d8........\.........<.y.....Rdrq....C..V..V....E...4./..s.s.I...Y[..Q.<.(.:..S......j~5.T...y.OR..'.Z..`.....a2...z.[.{H..R..Qy]...q.....Z....t..._.x.=

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	5328
Entropy (8bit):	7.964406478134746
Encrypted:	false
SSDEEP:	96:VgUgAZrsBgeUtnpulZ3B4yfWbN1GWg0yYK/7afEYiDUeyB9woNw+Z:VNsBjJPO6LYKuM3qBJC+Z
MD5:	78C13083AB0F66E14B453E431BC9ECAE
SHA1:	52724E994CC0B241EA50C9F67A768A1259CDAD59
SHA-256:	301D39DC40F7C8D7E6E701B5542DA14CACFFD24C18BD8447B39C540FFD01341A
SHA-512:	CEA76BA9CF5AD2A82043A4924957EBEC3E255C27AB2F8246875DB253D5B0AE51CD0347755482FC5E7BBCADC76DF4FA533DB7B45E0AA3970D737259553F56429C
Malicious:	false
Preview:	Q .l...!7E#J#b.zHw.....9D...?.i9{G.....F.d.....^.?..,......d..V.........YT}E.`....viE!2(......./.E..aEMWU........d..x..L'...4...c.>..3..8.1gL.UR......H7...`...BM.....g.R....~$..)....R..6..........S1X..{........RV...q.v......c.z.a#.^~.....%...w....@4..:..'.2..L.WD.t.>..}_.y9....QN..:.>.O)D.......`..m.lVh.......9.Dj\|j.........v>.......G...XuE..o.R<...5 H;.K._..+..O.o$...H.a`..q.Zzn;.bt.R........HD.W.1...^e.3.m.....Y...]...7-j..].._...<bvAm..Y...h..c-.a.r.jN.y....JZ.......".2j..`..4....9..wtwBM.p.=..Q.K...Z./`.ZqNLN4I.V..&...H._,.%....qY.V..\|.)S.`...m W~.g...`..N[<..w}/".d..D..z......^'.7.X.........)...#.z...E.K^.j.._..=?.......vN..YE....V....XK.....@o.OV.5..cN.0.....68..0.MZ....O..M...qu...7~..)....gu.a.jD...A.z....tw.T.....y.(....C...q\..}..}.a!.....r.kE.d.E.v..v.SA.......+.Y.o.m..C.t.k...I...........JK.q.d..r.c...Q..$...m.@x..[.^../.M.{......g\]....0.:.V...:...aT.:.....6%...4...F*.....t^.......Tu.^8.8...Z...cgy..Q..t.\|k..4.....

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.vovalex.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	5504
Entropy (8bit):	7.964046794141265
Encrypted:	false
SSDEEP:	96:YFxVpwxnTucnfLfh5C/NboO5BScJ7+6UegAvIFeUgCVUO5b/yG65utpTzVH5dTW:ObufLf/C/Vn5D9UHAhUgCVU8b6oJHXW
MD5:	7D0D9079C2A5C7D995E8DC3A6A2ABEF3
SHA1:	748FB5BD063012C7EEA2FAB6594FC079C35F368E
SHA-256:	A1F88FD6098E50924DF83AFF16D04F509CCE9F51A5D14F8BBDEE31B1B5EEB3FD
SHA-512:	9D8FCA4DC6E0980074B6FE2D776B2E33E0647609D698160377BF54E1FD2E962A0884D1C3739472745BF19F86CFC06ECA5570D54D603AAEABA404BCC1A912328A
Malicious:	false
Preview:	.j..?.AY1G.....t.#0..[.....B.,a4.\|0k3M.G0....S._R.....H'...W.[.E...B.+.Ez.N.`..0..1Ia..s6..d..&.s.........m.......4v...K...5A.s...8..UYK...EWLj.Ue...L.7.6z._.D..?.nm.U.(..T..w.e.H.id%..r......Q`M......v.g.....:........Y".w.r.o....N......N'...!@.....'..}D..jo........0....v.@.....M~.dg5C....W....E..%.6Ip.s..U.....>.R..u[.....+z...5./.Po.....i...\|..w..?.~...:tN<-...'p..Q>..t`....\|G...t........{..s}n=..P.....j..}.$.<.oO.....Q..K...(.c.Mi.c..6..........+hH7.UE....tn5\|v..8..q8...9Q.e...D.............Fa....@C.\|..v.......bN....3.>.U..K,d..W......Pwf.2.B...F.L.......r..._...".h.#..`K..D"..u.!.~..7.oK...../`.t..@.I.N...F..>../.b..4k.E0#....H.g.%..W@.z.....5k.^..&..JLC....f....M...R.((.....P~....#.6.k...}....7M?I.f%I...A.34 .5g_..%.yH.K....-14i1....P......r...+-.n....hb...P.b.*u..\|....fy.;f...~.........AEr6..8.Z.0uXj...%c..i..p.r..[....t....g.....c.'e..I.Yl..m.T.b..&.e0...;.j.m....0.b.\.Fj....N..@.Z;..eZ.?0V...c.Q.c.....?N..<.u....dR....}UP....

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	1274472
Entropy (8bit):	7.9751718924764115
Encrypted:	false
SSDEEP:	24576:Q5l/6EfIjQBmgtONWxCk60Sb8AQIpNE2PVo5Rkyzf0uGT7a+tiZO+uLJ:QTtQjUON0V4b8AVFPykyzf0uGT78ZyJ
MD5:	35EEE9A443C7DD9F0E51E2CE6C537B8F
SHA1:	94652575C38F443BE133A3EF111A759C45CF4E16
SHA-256:	4EDA2D9B8ECD7E682F30C6B6873D2DFC7DEEA8A8592FA20D74C4EC2D7A9E4665
SHA-512:	D8179F945F13C9502162D0C4CCEB739E8A077EEC428AA68A55431C5C9233039920F34B94CE479A8F8B9504570C2CB67342192357ACBA26CE8C51E0785CD29272
Malicious:	false
Preview:	X.T.\..G...n..f......'.....z>c5.].o:..qn.+..R....5......=......)..._.CdoQA........nH..e.9U......9...2..."7.x..'.@.2......RhtA.}Y.!...2x....N...2.6.8.v..=.L..0<....`q...Yj\|......R.....{..&.8X..m..\.j$.J&..Mx.{s...W0.......%....`)c.!.a.."2t.h......;@.....<...@..v!.2.X...\|..u^;..p..g.w..+.MIrB ..f}..........0.>..`<...s..D..1=<[.E..5..9B4n......%F.}.L.0.Y5g.0.<i......{@>..:.S.!......0.././\..>.[.:....r.dW\|..8[.o...v...._5.p....}.)...Z[.6..yS..4r...co.X..7.a..!.&@0..~>.....d.../Kr.3:...../X..z.S.&....E[;.uG/L.....x....a.F...y........{X....q...{. ..H.,k..w..."._R.Jc..pTJ..l.5r.+w.g`.Q.1...)lB.&_.m...l..6 %.=a.d*..p........E.KFf...k.n...T.$N'8.#Ghv...4S@:.7sz.....}!.....1..Y$./...-...i...:...... ....<...b`....e.fl...L_k.-j. z...H7.Jb0....V......-....9.yLV`....V0Z%...c../...E....ain..y.XqRB..o6^..j;..$. >.Vz..k..T.../mp.x.%a.p.0.}......;.....=..DD.[..S.[..]..<...E..ko.a..L.;4..X..[.W.Y.....1& K.Qu....'.C...;..38.v........:..}...5..Z

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	1274488
Entropy (8bit):	7.97512548582429
Encrypted:	false
SSDEEP:	24576:quqjt4gHzv0+7kmy6LiuJAkqUni35Zq7z1HdpiKEoL/IyiYOgh0uGT7a+tiZO+uV:quqjFv0Okmy6LicAnei3uXfpiqQg0uGr
MD5:	2D7998FCBCB6ECB548C7674120B1DB00
SHA1:	1BF9A89DAB4A2CC9A3290CB16F743FDEBB8EBE99
SHA-256:	16D17381DD0C6FEB5D764B9558A1CB314D2EA625D4381F7FFD11CEDC4EDB72E5
SHA-512:	2E2294847AC016E9C3A8801DA961689ABC82FB747B3BFB615C98CDCA5C10124793C0D3E01069BDAF032164BDDC49249AE4402F04116374D46174E6FB3B9F5532
Malicious:	false
Preview:	A.IS.n.<.3.J.8^%.,..N.i..$...6...T{M..").X.K...~.4&.....u...L.8.$..4..........[6.."...R.....\...-..=.......e.....c.~..-.Dl..R.".J;.D...Z..U.9.9...P._D.....5.4!..v.vom.O\.....VD.p..vD....fho.Z..2.+.z`G....U.3u.8...l.`)..>2 .$.Bnq;X..b~./....5(T3..jN.HN......U)..o.h..6..f%h".h?..C}_.5...>.q..\!@e....gp...8y6.8...z...\....\..?K..o.ki.37.+P..1...'......P"..wO......_...~?kjP.r...E.....N4.P....~...2.....'.<...)^sDb^....%c3.r...h.w. .}......R.D.........=.....\......S..o.....s).(..V.%.^~..i7..K..G...?..... :>.8..o.....H.+s......z..0...z.(..V.b.dh.+..=........[o..Z.;...b_P..n.xx`......d5...f.^O...(..^BP..../..%..O........+..Y...\&$...{n.Y.S\3.x..@....'...#...r.G...}..`u..X... y.....A....'....%z.` .l.......A..Br......5y......H..8..M...F.vX.`....V\|./.......}..q...]Q.Rw.S."./..O\|.i!.2C....W[D;D....&.F.z..6.[.B.A... ...CN.(n.....H..0..s..%M._e....o2..-..d..Nt..{&>$y..:De>.t....Q.........m..V.F.3K...n.i.F..`=.S.$,_...h... .^.2.;..M/W..i~.n>...S...JH.n^..g.

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll.vovalex.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	1274504
Entropy (8bit):	7.975247381042762
Encrypted:	false
SSDEEP:	24576:O9iVgMKqqAgaVrqOgT81b8N7EGQu11yeLro5h0uGT7a+tiZO+uLJ:OX7qk42OquGt11fHoL0uGT78ZyJ
MD5:	62AF163617C1DEC00AF296542A1C111E
SHA1:	A773AD8AADD3BBC10E4B116275976FD63BA9DFCC
SHA-256:	0385E4E80E1F5E67C12B2C094BADD1AB069364EA1650305881EE8F7ABD5C79A4
SHA-512:	DE2FD6D10EA00751ADFF30F7FE334C01A5B9FA3FE33A7D2622DD0698C9A7B4A80B8746A7915C8A7D6527FAFF96D1D50107D56568B52A479D5D61D7885463F55F
Malicious:	false
Preview:	..~.....A...{...F^..C.......DUg;.....n......8xs...h....................9N....9.k..zu....S>..X...^.].2.lN.u~.....X....&O..\.wG.+id5.....>. ]...._.Nun....J.Ke.[7.E.0.J....W.............'wv.}$..h...!,..Gm..?..r......A.6..b....&y.'5nW)....y.4.j0.j..Y...\...3W.5...hOlC.\|t.......f.D.j..[l[..y.pT....b..E..<.PJ..[#...\|.{....W*.f.7.......l!...Z..%...".....-...m.6...2..1.'..zy..=M4....%u..\...XW......r.2t....I..A..H.1.XDI......8.b...X.t....=\..2.._.........x.....^..~...@?X.t&1..6..i.P.....V.9....R.....8/).j..1.o`.P...F.V%GM..dCR,....G.l..l..#@...l..A...^.he...0......:..\|...M.......E...-.K..D.L.e................[.JJ`.Uas.fc.P.[.2./..i.....k-a.y#..Fyz....@T#..6.M&$..j.M.........]........?K........W..z..\.-_l..I.]M\|$X...t...@.c~>.1.d._F.Ac..s(SP......... .D.!..L8...F.8]T.&h.Qv).X..jp....Qw...u....u...Xr...k.H....fU.\|..{Jm...kV.8l........mn....w.t...~........<..iNm.....[a.e...r..D.}..?...d)..S.3....Z..?.Xd..:.2..RQ~....4.....2`...v6

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	28983312
Entropy (8bit):	5.196581450197957
Encrypted:	false
SSDEEP:	196608:/phkE+dUhs9nStX8Ec59UekY8m8DRCVxulHTLv:xGE3h0nUX8EgT8
MD5:	B2287F6447FD3B7A5A8CCE682AD128F3
SHA1:	A78EE1519A69017D87FA7336BB139AD811CE391F
SHA-256:	5EC14EB73FF72638090924F417BBC139C7D5D2C78A562388BA8EA67959F6EA21
SHA-512:	52183B49F2C10FE2AE92C47FF5A3B8F003A65D33AB072A8C92D64967F0C1892397228AD7F78C5F24FA7304FAD741D2319A0A3D0156444CF9BA65FF4AA4348666
Malicious:	false
Preview:	..6+......w..R..P.'..\|..w.../.......5<A....Z..s....b.^.P.......8..........iNz~Go.....F....k<..h..Q...T.>[.....{.-)X.9.q..uNW^y.GR..&........G....x.....I(d.....7-..XR...U.{]"...wc.O.i^l.Gem.D..B....p..}..Ba.al..H2.LT...%.2.....^.@'.A.i..^.cY.].C.0y...Z..5.![ .:8....m.k.......t...q........XR..=..R.r3nE_.-. l.-...z.t&3>1..#..3_..'.GL.SX...(..#M...:Q..-s.3.9zv?. s..T`f:.E.Wk.....Gk..........1.cP!......#..0...Y.tk.?.R..[W..FJu.....Z..... .tr.........N...W.w...CB....N6.+....P....i.U]udr........n@...:...?.Gj...;.Hm.,...(.."+.B..L...^<...f.A-L.t..o`..H..yos.?'...N......^.i....i..m.....>_....R..i6...Z..m.}....u.L.lAal..&.r;... `..+<..R...r.J.b...H6.f... ...b.8.d.!.(=.>....\|]..4....un ..\.u7H!..$`..b.(.>f..R..>rEk.',.%.."...pD.....\|..6.\.6..h@.............b..Gq.h.X.T5.).q..&..I..Na...'..i].RQ...1..b.,...`.%..._...V.L...58.{..{....<*x...u........${...XP.fc....k...Jdx....);....@.'.a..H.R.t.B$..m%5..c.8..AM...J...-~(..P.p.+..,.....-......

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	28983328
Entropy (8bit):	5.196618042096471
Encrypted:	false
SSDEEP:	196608:eWgdUhs9nStX8Ec59UekY8m8DRCVxulHTLv:PVh0nUX8EgT8
MD5:	B17B5937DB6DBC21257262E2B9D6A3A2
SHA1:	E781692D9ECC8F43968753B3BB2EE1EFDDF47902
SHA-256:	DC4F32D6C89482970AEC5814BCC78FD99A71683CA52FA3627431B2E9B7900495
SHA-512:	6E05845F749BCEBB8B3FB521959F6A288F9281CF3E9EE58EBEEEE2BDC821E5763FC8EB52593CB303608C2E87615077D6ABEEC5363C6659744530069F7D50C347
Malicious:	false
Preview:	.......7]#/..0.H5G%....@=).......}..B.^l..~4b.l.Y...c[...+..... .e...+>.i....M......T..!.Q...dO..[d.$Pl..G..T....j6.0.x.%\|G.......=a6.lO.......N..G.......M...)s.;....N\|c.(.+.{a....-.f.h........j.Z.2...S..b.S...-^..SI..4'm...L."...C.+..Ga...N.............j..)D.29.....].N..ptj.Oo..n.\G.3y_..B.v.K..C....C,.?;..H...+....i......Q7\.].i.JC:....R[..y..#4]>.....q...x7.......A.{Fss.4..#p.\|]...N...fw.T2...J...b.l:J.`...=...u.j.1.a:."........w\|qo.../.w.....KBL%C9.?.<k=...3Q.......F......`Y...\!b..Z.1gH..A.o....U....<./..mS.!..e...l..._.H..Q.......<..0....Sg.4........P,ee9.2E\|9hR4....1(..>...[.K.A(}.,..e.1.(.i.C6v.U.0W!.....<.....!H6l7.......\E.+)U...7T.....c1a..U..1..ye.JW...L)..,a.y.l.W.....lex.."..9..}...j.;?..5...WRx....yO,....0.Ra.......<..x....Y.#W......<p.KW.6<.:.........ZhZ!...,j...C3..U;l..%u.1.-.5...\"..E..,..y...j.0..l../.....-..C7...R$...S;?..=i0.....B.....W]......u.J....[_u.Y...?.;.3.Lr.;...3S...3.....hDB....j.Z'1.J....E~..G..r.

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.vovalex.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	28983344
Entropy (8bit):	5.196685637575083
Encrypted:	false
SSDEEP:	196608:VpiydUhs9nStX8Ec59UekY8m8DRCVxulHTLv:Vpibh0nUX8EgT8
MD5:	10C12055D61245E047D76D2622C70649
SHA1:	3C33278050036ADFBCEE9EBDF025DFCBAFA447BE
SHA-256:	B1172144FF852CC4D9F39D608CD88AE7A37B7F9FA7A9B462AF060FC44B56C1BC
SHA-512:	F541DA2B299249BC7A918921C3FF08D7F96F805B9B12C40BC75AE618EEB6F90C61FE404C459827F19CACEADDDBC59F62D11EEEB2121A14CBD86EBBD69072641F
Malicious:	false
Preview:	...a....f ......a...p...Z...B% ..v48..g........#...T..=..9]3.8.b.$.-..[.......Q>.W{......y1.+-+........T6.5e..rb..+:.$...5...E.Y!.....PG......4eQ.Z.w.4...Z...K..Q........]w.5[..v..YF.#J.6x.N..0.g.~...J...-.nyH.e.\.i.z.....X.n.r....X..O..U3X....R..9....A.;..%o1..A...'....-"T...T....U.TnC..X..\|. Jx.2v.=....].!..!.,../..>.......j..0.E..M!p~.s.{../H0..U..+W;9.....3.....6...6.Q....$..Q..{..d.".{..ja......\...S+l..b..a.7..e...zU..6/..>....Xe`..,r..i.bLN...\.ed.?n.. ........2q..UKW..@.....y.........g.(._.....F....A.J.\c...N=.>w.2.D.JegPe..tk...x..4m.N'....J:..B6`.....X...xg...9..E..\B..X.w..&h..tI.......7.:.6..]2.....^..QN.........a........[.............R......./.....[.......Ep.gd.+.K.....3y.`..~..e...f..-Z.{.E.Y.E..Y..:5..J.Q..BS.......yL(.W..m0l.@....d..~i......R.,..a..#..3./.UL@.8W..6...F..P...+*6.&A.7.V.^.A.Gj.@.L...../Y.P.[..P...;..>..k..s......4.....Z}~......r5.....k..._.D....f..+...%.G.B..a.DBpm.n.F~ .j..u[1.oi8p..HNE..../.hTU.B....3..?

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	17648
Entropy (8bit):	7.990789176007261
Encrypted:	true
SSDEEP:	384:1Tu365774+cw9QyDNho+ZIYpEGixGpx4ZopnjudCiDO:y6N8ELxE9xGb4apnCdCiDO
MD5:	CC4186AD05F18014AF7BC9DCDB94075D
SHA1:	7224A44A446DE265BE24666090A160EBDFF2C349
SHA-256:	F204DEEAA81B27E6015A49C2D572D82A4AE1D88F9799808BDCB251AF89D2C378
SHA-512:	E990720524C161BF4CF2B50259AA45BCE09B62D2BC029141FF90C212A6C8A7A394A5D886B2FAAB15C1EFEBE22F813ACFBEB274CA954656C3DD6995E293FDE7B7
Malicious:	true
Preview:	.Cv..WR......\|A.....\|n#W...bt....FU..E..1.(....t.^!..ka........&-..:&..).y.k..K].m...={..Z..D.7.98...>..7(7f.U.....[..U.i.^.....:.T...F...D:....R.~..D.....B...l.......Q.o...[.u..q.t].....Y.).sK:A. .[%7=sR.-..w...{..z..%S..:2...5.0.u..........@..}.BeG..?\\|.Fn+..'.@..Q.].y4.Y...!..".......H..K(o..R.$.......k......B;je...=.l:...oX.F.]F.J&P8...tK.v').c...M'....X9. 7../}.Gy.M.d....h.....z.T?8.]....,.II!........j.Z.QfZ ).\.....9.....>9...O....M\6....T.$@....d.^.]..`.c.N.....J.]..f.s.M........~Q.a.L.....k\s.p..~]..6...bJM.9.a-...`........v...l......I..\|.....R_..O....C.DN4)...)D\|F..........83_6...eO.g.>d......A_...,. ....n.IU...Z"'.=....E......."......n+.p.V..A..6.....l.iTk..0.l.!.d..2...p.n.......{6.z.a..4`..u..Y:...f..k?..6....(...c#..z.D.;.r.NDI4...\|...C....aC... ..!..v....e.rI.X..c.....g.C......'..O..r&l.q`32.S.g............$....."d$_.......D..z....1.\.%..4[n\........f.....;d....%P3.!........P.C.#!W../..9Y_.w......6;...V.W.,.;.B...g..<g*u

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	18208
Entropy (8bit):	7.989698546457713
Encrypted:	false
SSDEEP:	384:Vb9z97st5o1oU2QbMs4gNXuPNoewCeUinI5aTCHUyz22SbmuFXs/WIEbs7z:N19I61TMsPNXuwbnKHUyzLGFkPMI
MD5:	F391C04B321640AA3D87938BC2089693
SHA1:	8F60AC003EAE963E02A07038FCF4BECF476A2341
SHA-256:	1ECCFF7181D5E3AC6FD1EC720267698AF715798DC27C6F695B503D3F0873F1B2
SHA-512:	B4DDEB9C4C033EF3C8E4F10500D750F783BC4530BA3D06B0CF4528321E6FB3D2F194F860ED3BD725E5D49FD3A9F7825404F26FD81AB0D62CBB62CBD6A0AE6788
Malicious:	false
Preview:	Q .l...!7E#J#b.zHw.....9D...?.i9{G.....F.d...n.D......./..5Uu...j...,..q...U.,N%A.g_g..y`..w. .....;_.............GoNx{Tp<c.].g..)...f.....].A...ei.^..........p....u...W..A...r....4.0......5.._.7...#.X...^..+.....r.o.<.A.C...`~D.s.M..X..7V.m.i...n..%%,...k!.sK8..6.c...,.O...raD%..v...a...b.9..!.............{.[.(...+S....3.1....:.t.%x..V]Tq%v...`......A.....\.....@{.p.U.".Y.c.....l.e9..F.V.D..e'.]..h-...%u..b...+.!.. .Ei.R.m..4..j.v./.:.....f.s"....i}.B.)` ....M.KH..._..Ts.z%.\|.. ...W.......S.D.<'.O.....6......v(.H:.....l........@....+.k..gI.C.......w.........4..D....i..}..../.4..0.....{..{._...+..].J/P.h..flU....zm......<..{...8BS......X.....m.".U..Y..6_......V...,...^B.T.*......j.g..~.s...W.#...%..+...........u...g.>4{. .4.=.h..u\...nJ.A;..`.[.=x..9"....#.a0....9.v..m]....:.....%..#kiz.a\e..pd:p%#)7=..d..'/f..P..J=.,..#{,....=v.s.t...O..8a..)k`M...............~.+Uv=x..QN..&2G....<(.....R.y..B)....p..6k...5.X......z.P.C...X7.5g..&

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	21620752
Entropy (8bit):	7.9993354735388404
Encrypted:	true
SSDEEP:	393216:SIdQwR1hJYyhCn+QPxIyHSjbbb3LivRYhEZRn74+aYBnQxtzAyH2MCrEZRYfbm:LTYyhC++5g/s2gp74+aYB+t0w2Mb6Tm
MD5:	05CB3CB8A44FD40DCF7A1AF024FCA5EA
SHA1:	B7C14D35499E65B2F6BD38A0AB7B9CCDB8D42090
SHA-256:	A152E34C74B20FE6070D6676A57BBC47594F40000F413FFFB077CFEE497B7CE0
SHA-512:	B5AEA7A09E940B46223C629FECA2C26EAA1D59A17F26032551D5285806073AE606D778D1317ECBF7EA82A9634801ED9B586628AE82310549EBF7C81F0AD383B4
Malicious:	true
Preview:	.+.@.(.Q.D...cQ.H.V.\v.c.......<.....;.\.....Wt.[.B<u.t...,..~..q..+...t,Q0:.^.(.'.I_.G.u{.5...s\..X0d.V.1.....6:.;=.#.y../H8pVw.sb.xG.gK.1@j.....O.K.....=......OC.e....a.;5. ..A..C....<F.'.......LA....cXbY..Y.!..u......$v.....#mB].3.6b...9..PEG.6.@?..._'.....}.9.q...?7....-..3...'.7w..{.H.l......P....4(.......>...OZ.Sh..U.Zi..&uYN.VTh..NE.a..,`...s....K...tL...D.5R.'p....G1V...P..Ca.!x.W.>./K..].F..L5.o.H.......e.!w.(n.2........V.Ot...{.......L.....v6C.K.A.+p."..C8._...j.....d9..3."R..wW..Q...m.Mr.X....6).....N..@.I....~L[....@..m~.V.....H...K...,..q.T;.wE...Y.q.;.<):..m$>.=6....gD..+....$....K.q.l..%}..@8 ..7..........{j...5.5*..#R.G... ..;.......w..<.<HR.$.....~.....IVG..I/.p....R...Y..2..[.!....S...P....%..p+.....^....J..NR.}..)..@#.I....:..o &...y.0.....a..+...Nb.Q.....2.....?.^V]5....\....s..((W..=[&DI.\...9...z&d.8r._j.z.L...F..B.3+.......g.........u.z.6.\|O. .}M.?<.:>....4k.....p.h....ef.g.1...Uqg.l....z.....766."..3K...y'."

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	209280
Entropy (8bit):	7.999087907893065
Encrypted:	true
SSDEEP:	6144:6hXHS92taNlvkgQkhasts7StA7eBbgXfAXay9lwdr8K:2C92QNZMsmuDdqSwdrt
MD5:	30BC053DA992749BD859CE698FACAD50
SHA1:	7B6D313135924D5E1C8DED6C055DAF9F6BE29E68
SHA-256:	83DCDA0F425DD261A4D162E229D0009AF81E9FD9DC3D4F63FDC82C8DFB8B4AE2
SHA-512:	C37FD318F37C2D8B1AA2DD4C700EABE587E7855E286F823E33CBAFACCB9A7C2ABD7EB8B083124D882188D8DE039DEA441ED76C44267FB65B1AE7A084EC8B18FC
Malicious:	true
Preview:	X.T.\..G...n..f......'.....z>c5.].o:..qn.+..R.%.w.A=....0....}.."}..;......v.T0..3...aF.K]3.Q":..."P...Z..X.F.a....?"...T\....Q...lQ....5.m%~.w,:...G$..K%.e .r.Oz....U.)b..14...,Lp..H./..c6.Q.7...P..2@.^....(...!..%"X.k.72....QV.\|..../..7~>......b...m,f..3......wV`0.7.......`.j.sn.,..j.....8.....Z....U(...".P.\.>. ....k5...,P.?..8._..>.?z....;..g.k._....9.k.../9@jQ=.9..Z.]..va:ym!:n...#.....tf^.....$.....7.j..CI.~-i0....#...5a.p@.X.l\B..0..k.V.....v..g.....'...=.......pdg..mR..:g%...hTVC... ..;..X....2.k...."X...>.....ISt.H.n.E.Z).P._6..[..o..X.....fE.&..i...C..<H)..}5k..4..A...?...v.s.....5...L.S.-....sa.X..3.%..Y.....r..5......&.rE.5..G@.M..M......T.../z,$.h....m6.}..h.....H....~..O.l.w._K.Y.....Y..4o..R.......(....X..q..9.I.<0A..8c....i.lV?../.6..I......IG.M/..}..IK...:..n.2h]az$.C#..=.9.0..N...T.~Y.N...3..i9.Y.n..eY..!.U.....)`.T.......&.A"..zV..4.V....+.n..+;..ww:.".....M..?\|0.u...i..nOa!........./.-&......O@..j....m.DX..R.@.%

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	215824
Entropy (8bit):	7.999257978366826
Encrypted:	true
SSDEEP:	3072:3fbkIZI8kvzsGF+mwsMGwigl99f+NIlOM/3gEjGUQnNbjleN4M9UwI1QptF1YS7m:AIx3GIsNw1l99f0IL1oxjcw1yfWDf7+A
MD5:	1901A511BD32912EA2A4E19F79B392BA
SHA1:	7065C9E7EB40B03ED0FBE461CDC0409B416D7A21
SHA-256:	5C03B58513F8C4BFB7A8FF663A5C2D727E8800DC98DCEEB99E544732F9A64242
SHA-512:	FE5947D591256721EBA2888B75F217085EF96F9B7F796BB603A6FABA7BF084C95A7261A5DD19FDDD152921482A79DCBB0ED85D5E7E7CD8456D7769264EE03E97
Malicious:	true
Preview:	A.IS.n.<.3.J.8^%.,..N.i..$...6...T{M..").X.K...~..^...H'-...)gi....d....y...dI..W....A(.C0........6y...(.....e<Q.<.[.8e...N...r.F....:F{Dq*P-.L.fP./'..5E.^..X1.. g.....).eN.=.m..t...y.8..z.}..h.>....y...C.\|.[...;...g0......r.&..b.....[.r`..?...Br(Im.r.a3.W..M...t.o<.k^u'...(..;.e.i...l...&i..;...'.c.w.`b.\....U.`..!....l+3.z^..9....y...,.....qU..-F........V.ksC.].7z.T...C;\|U@...6.4.w&03a.p..4....ZV.b...'......\..?.B.,SRf......Z.Nz.R..y..:..f7.....F.4..J...7.....L....#!.a......U@A.....o..~...X9...V.H..y.f...G.A#e.^.....o.F]Z<u.W.N....t!5...N.....;..T\....i.\.i.....(^...{7,x....=.Nm..j%7...i.k..kL....V.:.B....v]u........@..SF.#...a.c...#B...D.....T..e...nH\|.ek.....vE..\|z....Q..K..,.........M.(...T.....x.$..7.+..U.l.J...X3.;6Hc{.O.5.CJ.ti..&....x{..[.>......_t....) c..:.1....3x.d.H.........=.cA..{....u....-...`.,......,..I6.u\.% ..>...y^.......m.X..{#1.n.E.3.#W`.c.0.'.[V7.....-.Nq...Z.8.t1.Eg..Q..-..F.....@.z.Z...%~6..a....'.3.9\|..t.KyA.

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe.vovalex.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	222576
Entropy (8bit):	7.999271222249204
Encrypted:	true
SSDEEP:	6144:fLrzleYTao4iB7Ar9CK9on5/eft6m6SR26L021s2wm:D3leYjb7gCKSuzpfu2F
MD5:	BEDC59514B33E35230FABDFDB4F0D3BC
SHA1:	16C1C5974321EFBDCFC4631A3A72F6475B041E6D
SHA-256:	E45BC6C49D78D5C6653F724E5F7E1A60A8B509A5C54769175731617EA176EDF3
SHA-512:	4ACAD1B0C9EAC3F7B173572F15ECD044512DE2744A46F4D0A5D55B728C7705774D5992A3993964F25CA479B306B4A396A32809B7DA3BB7C1EEDCBE7515718A48
Malicious:	true
Preview:	..~.....A...{...F^..C.......DUg;.....n.....O.v.(..tEP...:..A{ZL.F1....y.=.'G5...K.Sy..'1..k. .:('.M~.....GQ...B...@G..g2.f...@.b.q.wxf.S..)1.....4..U-d.JW..5O..F.7..b...P.Y..c- .K..X.\|..t......:.........jo.'.\|...Z.B...IK...X..9&%.aR....#..S..k.\.r..)-...\|E1.=0@.............).m.j..Rw.~..F4.VS..........ko.Ry...l....Qm8.$g.Wcw..V....#y..m...)...M......D.O...9U.....>....g....[..v.@..^.7......o..y..M9......5:.....:.T..T..c.5".7.?Vl...C.h.p>.;....\|..[fF.:..-..._......6b<..RA.#;-G~f.=.^.<..._.6.x)....<;9]'....OD6Gd.u\{.#Dv.w........KN@....F..7}_...s....zg.>;J......+....o/PE...:.)=......#..fs.W.._JW<......#ul.R.7...t.9.xo......W./..)N...A......>....em...B....S.N..g?k7.l,[.kj9"_..T@.20k..3..n..9.&.}..Q.....g.......N.s;..,\|`pa.B...p...;....^.rA...A..2_...Qb.....@]R,.#..e.1...r...!...,S..hI.......y}....>.y..W........(..(8d.n..e.b..T...h....V.".6...@.1i..Z...:.....k..p....B.}&yd.:.f.?d.w... ..M..4.@Z...eF..A..p....vk.........*DWT..c[..j....!l.?..

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	9833144
Entropy (8bit):	5.412282692407661
Encrypted:	false
SSDEEP:	98304:d1cXm3P+kM6ChmNH32GmrSNVYpKz2whTzDp+El3nv0BgeK:Xz+kM7mNHGGmrgVUcDpN
MD5:	6974BA7884C9FFD938BB931E3A7AA182
SHA1:	971794FB6FB40C7A04D6DA0719357CD0D159148B
SHA-256:	1A238128DDB19666025AD5175560B200AC65987B606CB805B84EAF03C701103A
SHA-512:	D013AC2ECC1D82ABB1CB49EC12770F26FFF1779926F7DADBC522D6F3FD95A85B321795D4EB6A712DB3130A2FE4ED2EB943511F4DAF81FC95C68586AFC77E6FF8
Malicious:	false
Preview:	X.T.\..G...n..f......'.....z>c5.].o:..qn.+..RA.X...9j.....t..S.......}.+.l%.(.,..hs...QjaX..C@km.;....h\v3.....~X..Y.a...m.^.s.us..e.C.c.^.."../N:.......{.n.......!...[l....t..$.9.KL...O(Lr..+.7.Y.u....L.&N.<....ql.#.4....8.Ym.X..[.&.u.cZaN...Tw.=..."'.......$e\|.G.!fZ.h...fQC..q...vP..4n.Q.._.25.i..\|r........,xjSTe.f...>.."..z...x.].j...'..8y.....m..5@.z.>S9........]d.....N[ap..T.x..P..'.&u..C..Q.V.....-x..O..-.7.<.h.x.o#....f3._....@..z(.2W..nE.8.D.=.Pn.@W.t....n..>=..mt.....<$z.Ce..P..,...+_...H."...Z..Q..7M....[.......0.@L../n...u.J.,.r.%.>...~.W5...J..x...B.5<....l.....R.LJ....+..H.2t.BY....EW......j.r..`3....Q]v.....T.\|.<Z...L+.1.n2.a.."....Z.....<(Z...g. .. 0P...a-}.....S.E.4.[!..o.y{.....v.E'.&.l.&.-..~..._.3G..A^db....Y..D......I4N..$.%.........`.u..?.&J....E....-......or.....<.W. 5e...7...E..(6..9,..2...gA.j..\|.c...)....UH.k..7.8...\|.s.b...s.t=.=rE.$/.-.D..@jz.fJ\|}...^.)..L....{.pn....z4.!!D...`..zQ&...J.;h3.

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	9833160
Entropy (8bit):	5.412469524594749
Encrypted:	false
SSDEEP:	98304:CYH8WQ6YBDp6ChmNH32GmrSNVYpKz2whTzDp+El3nv0BgeK:CYDcBV7mNHGGmrgVUcDpN
MD5:	89868DC031F468B1DB6C5F89A369CA8B
SHA1:	6ABE1539E960128A178F37E3D91E40A63ED726A2
SHA-256:	3B1A40B65835AC1826C235ACF7BAB27AC323AD8815D6EFFE58DB883D1E38BFC3
SHA-512:	EEB9D612135F14FA1DBFFC35D616B01862D6B88C1412E7CF8107FE2E1F46B75FA2E274C05AC4CB77F97E16F7EE01E4A2B8B567402396E870F67DDECC909C1F7E
Malicious:	false
Preview:	A.IS.n.<.3.J.8^%.,..N.i..$...6...T{M..").X.K...~.P.svT.[O..@).b.P.uA...'jMgN.).3,?..99H..b#.83kK...W..c.p..)r..3 S..2...qi.^.V..c.B......6..$8.E@.....A....;.....;..tR..y..f2I!.6..y...KNe..s.....<..k......i..^S.%..W..4....K.h.\|W./.......X..\|[d. ..6UaJ3..Kw..bY...vfH....v.....p..4B....8.%..P>..\|.......u.d"........%t.i......P.rI..[.N.M..\|V..q?l.i..3z4.u[..3)h..E..4.K...B......\|.x".p.<N./..w....W...q...G.%9..?\....(F..O'":.?.}.$. .2F/......z7..V... .^.sE......U..9%....(.8...vGTe........f..9Q.x...v..]..k`j..[1i5 .5...!Pu./h...<#.VO.x0...L!X.#X..1..K.[... K.$.....Y>C!..kuX......t{I..!.b.....O...Gl...............z....s]..`.U3bNi..'..+....8-..[.(^..............[i.uVW..vF.%...k...l.....u...i.+i.p...~..A......2D.U'.)I.=..k..V.F.X...^.a..c...c..K....<...A.6...zM".Rm.I.T.i.<...-@..a...I.X..J..s.t..2/.....RVI...~SNx....k...q.'.[OA.j....C7k............(^.%.;.c2kf.....L.V...(...iV..TU...tH.Xv....g....4....k...X...e.Ib.g._z/........C.....L...{.....j

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.vovalex.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	9833176
Entropy (8bit):	5.412387024879665
Encrypted:	false
SSDEEP:	98304:mYrJCBoQQN6ChmNH32GmrSNVYpKz2whTzDp+El3nv0BgeK:hkBeN7mNHGGmrgVUcDpN
MD5:	585576F0A769F583CAB4B6ACAD0D7608
SHA1:	5E52F9685C245B67111514687F5558A5A08121A5
SHA-256:	75A80910AF16C1CB3BE99EE6A3C9B467DB1E3A0E32C419136CD2C56E636A94F1
SHA-512:	50BE97520011E3BE71705B6EA39142F0B8167539CD32123401517CC1AEE2075E30357F20F5F70F2016282E6F1B5B036D29C9D9A77CF00435D5ECCE05FCCC2D9D
Malicious:	false
Preview:	..~.....A...{...F^..C.......DUg;.....n.........L...],.Y.aa..}f.9.."K.......ir.[...`& ,D...W?...-.2$.v'^3..;k.A.7....Y....j......g....e....q.+Gp.oA..$.JG.....\.....[>.`/a.........r......{...n.._.iw....B.`....1..Y....wb...NR...(....U...v...N5U'.?.G...d...Q."ED.lI..81ty.B...r ..m.<.../.o..-.....p.N.l...t...+D...S.#......].V.4.j.J.!.*....5m..I.cz3~.d....5.."...J..Q.....u..:..O.J.^..\|..J.2.r.....{..../.8.q}.~.....<Z....6....a.O..b..!.D..r......a......J..7....._Q..........M..O........z%h\|.W^C....RS......=....'.m.0...G..)4.9GQ....-.b]..w;.^..6...P"Od...k.^x_....S...Z.j.A.'......m:.....e.9X...........j....".S.3[.$/V..."!..nT`....._...R.g.R.!..\|dp.....u....../..0....v.....g..}.<....h...W....O\.........5.+.e. ......8H....#.UUv..44.\.\|-~R..`J".... .J...k3.F.f...y9.d.Z.8..T..ke..bXi:yg......3.9'..Y.....\|.+.c.x^-......f.x....B.V."\}..?\.../e.NURa.K+.}...5..H.f....&.M.5.~8L...(.{.J...-fi.x.o..v...S...(..n]{8.. ....S....G.%..'..J.....sa]

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	608976
Entropy (8bit):	7.999683277114848
Encrypted:	true
SSDEEP:	12288:JHxQEUwhCyvzaHsUF+o4rE1GPqFJK986eSIZgofq7fq9Qw7UOWA42:JHxQJwhCyLfUkoQqFJKs7qu93sd2
MD5:	731E73106C648BB12D0A06E1C158F048
SHA1:	A2056C9C57A0F0CB1F7BC956BD53E54EBB42E5DF
SHA-256:	1467D175CCA1C54F606FD0FD253D0EAAFFE697B6B9D6293FF9E7568B95D0FB6F
SHA-512:	6D4725F77005765931AD370BEE05C6846B20325ACC98F68D738B0299EB9839649D3D8EC30E922B9A29532D0E04E151BAACFBD3FDCE5E47A744BAF53471D4FF99
Malicious:	true
Preview:	...#.n..<..-...F.f.#....`..4bm...nU.u....O...[z.:..x.Fs>.ZJ....O..-4DQ...^.P.".}........Z........vs...!]&...I.n.Q#...Y...fw.s..y#z.,(...N.<r.f....z\3O....q.u0....]....V...S.2..}KJ0..E...k..SN...N...~A..........V.aHQ.R..G..$}w..\....r9........s.Jf..-.._...j....K......-..V....o..q..v.+D..g~..u..u.ZQj........X>..b}\|9..\..{.L..4.^X.....2s....O..u.U..x..Y...(F..\...Q...}.-............!Q.9.9...j.....P.(..%R.>a..$.B+.w..g.2z+..\{8..a.V..v=.2.........X3....x..!..=t..B.E.$.d.8..9.Rz.i...g.%o...e....&]....pu...3....L.....>.#...G.NW.80!......<0F...`.r.o..........&.......M).......Dd. VGb'>Q.Zr..n...&I.a...!r.(.,C....6.0J ...qf.6.kh\|.3%L...aO...g.=./.2.g.TA..@....\..._.L.M/,.......[.[..KO.+........?.+..I5..%H..fS.J.....N.eK..o...4)...E..^+G.6.@..J.paVH.....3o....1..4eo......M.9.;C".-D.D..f(..q_.....Q...).nY~%......(........xm'.N....*...~,.h.......7..@o.C..../e\|.._....4..o.."X.._.f;!?GV._.YeO..T..D..-...).CFS.."......!8'}KF......0.}.......r..4P[

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	628016
Entropy (8bit):	7.9997177403231
Encrypted:	true
SSDEEP:	12288:2aZg8yxrxZsBUFBNvocWPToRXpTkU/Vdlfpa/Mou7Df:2a28yxFZsB4vvocWPTo97ba/A7Df
MD5:	8401BD41A6F9D8C93423C97C09962621
SHA1:	5C6670647226E92E94B28E2E27FBA39D1055155A
SHA-256:	F7B02BA196F796A53884BD2D32C1AEAB8E179A5292692C9A520D505ED15849C6
SHA-512:	A154A17957177542D759C863A75331E356E582BA09A1A2FF776275509F6ACF26BA29911F5E3F93708EB537F13DC07C6D54097C4693857AF83C105D5C71AF67F6
Malicious:	true
Preview:	.0.....B.YU......l....q...7..T!1;o.....(.I..r... 0....DV...%.C.....&...WA..d$.......j..+._A.O9.....7o...8F......@.KCu..m........kp.\..^. ...=....)...0..8z.D-.V..L.`..yM9.]}.RrA..g.QFi..]@_...}.P&B.WS..n=-..=..u&..P.7{.K.2.v-.ud.#.S...}._.:......v..0...60.i..WO....k....&...m.....5.....!......5..h...)[.)g...d(...]....tG...0#."&...$2.S...jRG...,&g.l.....n..cU..A.z1"...n.j.#b.....&.LB..,75..l.......w<.rQ....q,t.6........;#0.........v..R~.....3.j...<..D..x$.... .m..y.{..g...<........D.y{`...UL...%A}......5.....M=.P.v...?..C....S...../:.?.].......y`.b......\.......M.\|.p...F./n..#....V..].,.JGj.!.H.....E....)\.J......nw"..@o]..$57.....8.vr.m.S.`.x/...f..6....t.Z.....'..!..?....S..w.+T...uJl.7..wu.+....d..b.?.8...Y....{......VD..:..1T^D............<.An'..^.E......K...U8.........N..S.T..pK....J+9m....8T1=.......(.^..6b.....u.a..N<...v...^..0An.8..4a....).j3..w..;YyjZ......07...>...#......g.&...)....GbL0.C..^........n....sf\\|.P...L.M1...$....

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.vovalex.vovalex.vovalex Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	data
Category:	dropped
Size (bytes):	647648
Entropy (8bit):	7.999743734196676
Encrypted:	true
SSDEEP:	12288:CICCKi+Xc6zEBUg8N7X67/TbPITxsOsxKQEXbYNS2QEIJGXFN8WownrKcH8hM:CVCKi+Xc6WUnX6r2s8QybYNSXVQX0WoW
MD5:	E2A931A250BF5E5CCCC709053AC6C469
SHA1:	F4F3C9B191D6B4E7519E315E77733BDD3E5817F4
SHA-256:	B2C1A03BEE4FC4B77182BD3A9CCCB37BA31C5937922034C06C4FD88E659FDC00
SHA-512:	4F22D9DCB63D991E6653192BAD42762C6E79578CCA103F423982301866ABCCA034CEB513EC8FC50A6136F4B0863DE0D108D8EDB42CC9072FE97220612B856897
Malicious:	true
Preview:	oN.B.a.....\.af..Tp.&....=.<9.K;h.Sm>.<.H.c.6...J......&<...)o@..j..P..W....v...X!..Ai.#.Yw.o.V(nN..Q....a.eO......:.I#...h:..X.vN.+..&.$.x.W.M#"...2^....F.....c...f....U...S...y.{.4hS.....'g..j.Tv.g....ez...........d..N...du.\|.....]s.X.8...g...c....EUqR...p.....?...(..D..Z....;.Z.L..>^X.;.U....D.Sg.."..".Lc.....r..]..&L...cL....7A.F..a,v@;.....~.J.D..'.......dV...^....{.J.......P.i.b...%..sv.E.4....wP'.f.=.7....J.o.9..k. ..z.,..=o..Ov.i..'[..Kd.2...3.om.....\r..-...@.>.....c.I..H.3>f.G.D.........%..:.R...p..</...0.H.-6...hs.g....E.X.6..~.....T.k.;...j.}.xkx.eE..9.1r.W..s....;-....}lKl.......M.4....+...o...Ys..).G.y.../......}...i..Z...?...D....xa....Jk..u..-8y....r. .8...?..K<.......^;......x..E......c[.rPc+.PA7O..3^. .T.vQ.T.7).g....:2c..?...RG...M...5m.n..^#..k...F.N5...7!..\|XQ1{...t.a......n^4..3............5.d}..8t_./.S....9..c....b.>>.n.ic.^..../..2GC...l?........lB...=A..S..6.".......L...\|`......c.E..%z.\.K.j....T.M..w!.t-.X.y7'..3

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\uTorrent.lnk Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jan 30 19:49:43 2021, mtime=Sat Jan 30 19:49:44 2021, atime=Fri Dec 11 04:02:16 2020, length=2146776, window=hide
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	4.9143893199545445
Encrypted:	false
SSDEEP:	12:8mqM164gy+4KCSx8oo//qXeLSX/dkWGqOjATHXk3qMJU3qMJ7YL65YLFGm:8mxHgy+zdboiX4iGhAotqt6uG4m
MD5:	7976576B8F9BE13E32E7081B8BBDB9C5
SHA1:	B491572CC12FEF71CA49AB5BB5A1FDB067946471
SHA-256:	1FE2DA39A3159A13877D97F6744E108A308F1E042370ADCCB64B333111DDCC3A
SHA-512:	3FB2F35F707375511F5524B89ED489A0456FD8F98AC30756008DCCF49C02CCAE92D374419F505D06EA37473F6B342A8A902A54142758A75477E4B5690634101A
Malicious:	false
Preview:	L..................F.... ...P..pI.....*pI.....n.z..... .......................:..DG..Yr?.D..U..k0.&...&...........-..M.%.:....Y.qI.......t...CFSF..1......Nz...AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......Ny.>R.......Y....................f.(.A.p.p.D.a.t.a...B.V.1.....>R,...Roaming.@.......Ny.>R-......Y.....................U..R.o.a.m.i.n.g.....Z.1.....>R7...uTorrent..B......>R5.>R7.....My....................C...u.T.o.r.r.e.n.t.....f.2... ..QH( .uTorrent.exe..J......>R6.>R7......z........................u.T.o.r.r.e.n.t...e.x.e.......c...............-.......b............-.......C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe..@.....\.....\.....\.....\.....\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.u.T.o.r.r.e.n.t.\.u.T.o.r.r.e.n.t...e.x.e.'.C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.u.T.o.r.r.e.n.t.`.......X.......216041...........!a..%.H.VZAj......-.........-..!a..%.H.VZAj......-.........-.E.......9...1SPS..mD..pH.H@..=x.....h....H......K

C:\Users\Public\Desktop\uTorrent.lnk Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jan 30 19:49:43 2021, mtime=Sat Jan 30 19:49:44 2021, atime=Fri Dec 11 04:02:16 2020, length=2146776, window=hide
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.947207426204803
Encrypted:	false
SSDEEP:	12:8mqM164gy+4KCSx8oo//yv1SLSX/dkWGqOjATHXAOqMJU3qMJ7YL65YLFGm:8mxHgy+zdboaiiGhApqt6uG4m
MD5:	B341695B69447CDB4A187D2AC195F8BD
SHA1:	A54D20220D2917E4824FD655BD436DDADEC33FB9
SHA-256:	EA3F1718D1F20FA801F56B7695D407C2074F10440DD19E7201870ECE93BE5F2B
SHA-512:	16FC6EAA01295E34EF4A6C2782645EB13CABA8E6CBD214AD65F0074A60F069D2A391E3441014C39B7DB517804F72F1AC932F317BCCB72C887C5A1930A8F07DC1
Malicious:	false
Preview:	L..................F.... ...P..pI.....pI.....n.z..... .......................:..DG..Yr?.D..U..k0.&...&...........-..M.%.:....Y.qI.......t...CFSF..1......Nz...AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......Ny.>R.......Y....................f.(.A.p.p.D.a.t.a...B.V.1.....>R5...Roaming.@.......Ny.>R8......Y......................H.R.o.a.m.i.n.g.....Z.1.....>R7...uTorrent..B......>R5.>R7.....My....................C...u.T.o.r.r.e.n.t.....f.2... ..QH( .uTorrent.exe..J......>R6.>R7......z........................u.T.o.r.r.e.n.t...e.x.e.......c...............-.......b............-.......C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe..1.....\.....\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.u.T.o.r.r.e.n.t.\.u.T.o.r.r.e.n.t...e.x.e.'.C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.u.T.o.r.r.e.n.t.`.......X.......216041...........!a..%.H.VZAj......-.........-..!a..%.H.VZAj......-.........-.E.......9...1SPS..mD..pH.H@..=x.....h....H......K..@.A..7sFJ............

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	Microsoft Cabinet archive data, 59134 bytes, 1 file
Category:	dropped
Size (bytes):	59134
Entropy (8bit):	7.995450161616763
Encrypted:	true
SSDEEP:	1536:R695NkJMM0/7laXXHAQHQaYfwlmz8efIqigYDff:RN7MlanAQwEIztTk
MD5:	E92176B0889CC1BB97114BEB2F3C1728
SHA1:	AD1459D390EC23AB1C3DA73FF2FBEC7FA3A7F443
SHA-256:	58A4F38BA43F115BA3F465C311EAAF67F43D92E580F7F153DE3AB605FC9900F3
SHA-512:	CD2267BA2F08D2F87538F5B4F8D3032638542AC3476863A35F0DF491EB3A84458CE36C06E8C1BD84219F5297B6F386748E817945A406082FA8E77244EC229D8F
Malicious:	true
Preview:	MSCF............,...................I........T.........R.. .authroot.stl.ym&7.5..CK..8T....c_.d...:.(.....].M$[v.4.).E.$7I.....e..Y..Rq...3.n..u..............\|..=H....&..1.1..f.L..>e.6....F8.X.b.1$,.a...n-......D..a....[.....i,+.+..<.b._#...G..U.....n..21pa..>.32..Y..j...;Ay........n/R... ._.+..<...Am.t.<. ..V..y`.yO..e@../...<#..#......dju..B......8..H'..lr.....l.I6/..d.].xIX<...&U...GD..Mn.y&.[<(tk.....%B.b;./..`.#h....C.P...B..8d.F...D.k........... 0..w...@(.. @K....?.)ce........\.\......l......Q.Qd..+...@.X..##3..M.d..n6.....p1..)...x0V...ZK.{...{.=#h.v.).....b.....[...L..c..a..,...E5X..i.d..w.....#o+.........X.P...k...V.$...X.r.e....9E.x..=\...Km.......B...Ep...xl@@c1.....p?...d.{EYN.K.X>D3..Z..q.] .Mq.........L.n}........+/l\.cDB0.'.Y...r.[.........vM...o.=....zK..r..l..>B....U..3....Z...ZjS...wZ.M...IW;..e.L...zC.wBtQ..&.Z.Fv+..G9.8..!..\T:K`......m.........9T.u..3h.....{...d[...@...Q.?..p.e.t[.%7..........^.....s.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.076355638222261
Encrypted:	false
SSDEEP:	6:kKJ3lXbqoN+SkQlPlEGYRMY9z+4KlDA3RUeKlF+adAlf:lo3kPlE99SNxAhUeo+aKt
MD5:	98E94701B850E8E576A5B8060F563DC4
SHA1:	381502CB544440964A89D27F92316C29832FE174
SHA-256:	B0EA35FA09BF4370101DA480559C2EF17B41154C38A1D32942743C9BB09A4175
SHA-512:	CCB7496BEFB298236AF633C39668B7DCA817AA5C50A83A3C69B0CC44FBF3BDDF7ACD8752C558D4A53AAD4E2CF3CEBA1BF54256FFDC45221A841F788A7880BD2B
Malicious:	false
Preview:	p...... .........."{I...(....................................................... ..................&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.e.b.b.a.e.1.d.7.e.a.d.6.1.:.0."...

C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32067320
Entropy (8bit):	7.998739469711028
Encrypted:	true
SSDEEP:	786432:d7y7AabxdnURprN3BaWEVYPZ8D55V+qE/PO3eF9xh8Gs2ZU9eiWYw:d7yElrN0Wq0ZK5v7eF9x+y6w
MD5:	70ED5E8A31519EC2FD1131020FE8421B
SHA1:	1FB74D8D39E7C8A36113AB51F14422930C3B9128
SHA-256:	7F329D5A3D12B3B9584C98A4D0E40E6CCFF21A12BF57CADE16820557C45ABA13
SHA-512:	59650F55738281D6421723E1C04976F6602F6431FA7E804992BD6ED485BF8415518C8B3D01C0AEC186325EF1FB6FF6A0FB82E1D2EC31506F4529A17F940E277B
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 6%, Browse Antivirus: ReversingLabs, Detection: 10%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...Rm"[..................................... ....@.......................................@......@...................................................................................................................................................text...\........................... ..`.itext.............................. ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.................&...................rdata...............&..............@..@.rsrc................(..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32067320
Entropy (8bit):	7.998739469711028
Encrypted:	true
SSDEEP:	786432:d7y7AabxdnURprN3BaWEVYPZ8D55V+qE/PO3eF9xh8Gs2ZU9eiWYw:d7yElrN0Wq0ZK5v7eF9x+y6w
MD5:	70ED5E8A31519EC2FD1131020FE8421B
SHA1:	1FB74D8D39E7C8A36113AB51F14422930C3B9128
SHA-256:	7F329D5A3D12B3B9584C98A4D0E40E6CCFF21A12BF57CADE16820557C45ABA13
SHA-512:	59650F55738281D6421723E1C04976F6602F6431FA7E804992BD6ED485BF8415518C8B3D01C0AEC186325EF1FB6FF6A0FB82E1D2EC31506F4529A17F940E277B
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 6%, Browse Antivirus: ReversingLabs, Detection: 10%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...Rm"[..................................... ....@.......................................@......@...................................................................................................................................................text...\........................... ..`.itext.............................. ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.................&...................rdata...............&..............@..@.rsrc................(..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe Download File
Process:	C:\Users\user\Desktop\yVn2ywuhEC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32067320
Entropy (8bit):	7.998739469711028
Encrypted:	true
SSDEEP:
MD5:	70ED5E8A31519EC2FD1131020FE8421B
SHA1:	1FB74D8D39E7C8A36113AB51F14422930C3B9128
SHA-256:	7F329D5A3D12B3B9584C98A4D0E40E6CCFF21A12BF57CADE16820557C45ABA13
SHA-512:	59650F55738281D6421723E1C04976F6602F6431FA7E804992BD6ED485BF8415518C8B3D01C0AEC186325EF1FB6FF6A0FB82E1D2EC31506F4529A17F940E277B
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 6%, Browse Antivirus: ReversingLabs, Detection: 10%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...Rm"[..................................... ....@.......................................@......@...................................................................................................................................................text...\........................... ..`.itext.............................. ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.................&...................rdata...............&..............@..@.rsrc................(..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\_iu14D2N.tmp Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\unins000.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1415027
Entropy (8bit):	6.483660919858784
Encrypted:	false
SSDEEP:
MD5:	D2E364571A8BC684C4B11FD499CD023D
SHA1:	E140969E18FA53B2F71EA4B21DF8A0C8901BA64C
SHA-256:	12E7027985EF3FBE0A7CDAB05745CF577366943AE199ED673110E50FCD7EF898
SHA-512:	BD3288BA818D4798F38B17088376CA6CBCCC5959E1B99A8F15DB9900F72F3AB75E29710F1F3B38C13502439379CA8CB619BC23DF44EE1C060902622AFBFB416C
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...Rm"[.....................$.......%.......0....@.......................................@......@..............................@8...@......................................................0.......................................................text............................... ..`.itext.............................. ..`.data....0...0...2..................@....bss.....a...p.......L...................idata..@8.......:...L..............@....tls....<.... ...........................rdata.......0......................@..@.rsrc.......@......................@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-50A2H.tmp\_isetup\_setup64.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: FrC4UAhnvX.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.DownLoader36.34557.26355.exe, Detection: malicious, Browse Filename: 9oUx9PzdSA.exe, Detection: malicious, Browse Filename: atikmdag-patcher 1.4.7.exe, Detection: malicious, Browse Filename: Atikmdag Patcher 1.4.8.sfx.exe, Detection: malicious, Browse Filename: atikmdag-patcher 1.4.7.sfx.exe, Detection: malicious, Browse Filename: VoiceMan Reflex-Setup-V3.0.3.exe, Detection: malicious, Browse Filename: FastKeys_Setup.exe, Detection: malicious, Browse Filename: FastKeys_Setup.exe, Detection: malicious, Browse Filename: atiflash_293.sfx.exe, Detection: malicious, Browse Filename: sfk_setup.exe, Detection: malicious, Browse Filename: atiflash_293.exe, Detection: malicious, Browse Filename: Softerra Adaxes 2011.3.exe, Detection: malicious, Browse Filename: atikmdag-patcher 1.4.8.exe, Detection: malicious, Browse Filename: atikmdag-patcher_1.4.8.exe, Detection: malicious, Browse Filename: OhGodAnETHlargementPill2.exe, Detection: malicious, Browse Filename: atikmdag-patcher-1.4.8.exe, Detection: malicious, Browse Filename: atiflash_293.exe, Detection: malicious, Browse Filename: OhGodAnETHlargementPill.sfx.exe, Detection: malicious, Browse Filename: godflex-r2.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1392128
Entropy (8bit):	6.509329780486978
Encrypted:	false
SSDEEP:
MD5:	3A7636D874B391801839C0BEE90BED21
SHA1:	7A5FEDD3653E8240739B4AE4490A9872B813EE6C
SHA-256:	2F7BBA5E7D5C127D9372D7E7F1DABB83C077F547FE15AD15431B7A686A079FE8
SHA-512:	ED993F0A19D11AFA0A821659462ED205BC990C3637A0E4D2292F0FB85C0C1491006966BDD32AEFD2567EC8F86E8E579C3B8C40721E87D5EA62FDB16E0F6F0314
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 6%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...Rm"[.....................$.......%.......0....@.......................................@......@..............................@8...@......................................................0.......................................................text............................... ..`.itext.............................. ..`.data....0...0...2..................@....bss.....a...p.......L...................idata..@8.......:...L..............@....tls....<.... ...........................rdata.......0......................@..@.rsrc.......@......................@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1392128
Entropy (8bit):	6.509329780486978
Encrypted:	false
SSDEEP:
MD5:	3A7636D874B391801839C0BEE90BED21
SHA1:	7A5FEDD3653E8240739B4AE4490A9872B813EE6C
SHA-256:	2F7BBA5E7D5C127D9372D7E7F1DABB83C077F547FE15AD15431B7A686A079FE8
SHA-512:	ED993F0A19D11AFA0A821659462ED205BC990C3637A0E4D2292F0FB85C0C1491006966BDD32AEFD2567EC8F86E8E579C3B8C40721E87D5EA62FDB16E0F6F0314
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 6%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...Rm"[.....................$.......%.......0....@.......................................@......@..............................@8...@......................................................0.......................................................text............................... ..`.itext.............................. ..`.data....0...0...2..................@....bss.....a...p.......L...................idata..@8.......:...L..............@....tls....<.... ...........................rdata.......0......................@..@.rsrc.......@......................@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-DRN6C.tmp\_isetup\_setup64.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-SMFB9.tmp\_isetup\_setup64.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\utt4115.tmp Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Preview:

C:\Users\user\AppData\Local\Temp\utt5E55.tmp Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	2880
Entropy (8bit):	5.516942991099676
Encrypted:	false
SSDEEP:
MD5:	4EB3D083AF3C02221375937AC5FA0034
SHA1:	58A8587B2BE4E88CFDF9098ECE2EA30332D41C38
SHA-256:	10D8B828AF4080AB9D7A4943A64960BF047637A95AC3AAC046B9E7B7232943B6
SHA-512:	4BD297748980433C590F90178025196E135472CC832186CA52726008B7A69B50B84ED49ADCAB7C8542E95714C4C19044D9FDC432FD780BFA63E843D4BBC2408F
Malicious:	false
Preview:	MZ..........................................................@...PE..L.................................................@.....................................................................................................p............................................................................................text............................... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\1f91d2d17ea675d4c2c3192e241743f9_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	data
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	7.276850022968998
Encrypted:	false
SSDEEP:
MD5:	EFD971DBD0EA54E54A6F2FE4D85FD644
SHA1:	E38EB16ECCB71BF485361ACF24420C5C7E1E101B
SHA-256:	2820462B77D4F784FADEA72130DAA11EA76BA881E3865AD5475F9421493BAC72
SHA-512:	CB24487B5D5745EE996029DFA8CD9A9EBCE6508F3DA0C278756961405B03422F8F75E001E8A625B0F36807CA6AA3001D12F0F7B13A058AD3A88E60E96D12A0B8
Malicious:	false
Preview:	........@...............................C=US,ST=CA,L=San Francisco,O=BitTorrent,OU=uTorrent,CN=uTorrent.........@...............................C=US,ST=CA,L=San Francisco,O=BitTorrent,OU=uTorrent,CN=uTorrent.....................RSA1.....................#....y...1....0K.I.....]\$.5...G...w....2=..X..%..9lY."~G....}M.B.mM...._w.b.d..8..bXE.....(......7CA.6......[/.OT.....................z..O......:..m.C.i.%.S......,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... .............&...;X."..................... ...?n.....i..~..M..W...-.?..O..b.........+;.YR....RL8a.F.J....p.y.O.z..pr..Rw..#T..b..)V..#.R)D..~.2ylu.f...`...._..x...G.M....ymY...1.w..c^...R......ZZE.@...tt9.....t.&..HI.KO..V.1..#......6..l..M.. ....L.7......7..Lcz.gn.>.5....3.B.[...].2.? ....q5.2.vO.J.J.b..}...e........9!.8{."^.<.a.9+..?"S.../.`V.R.c..#..K.4.[....5..Ae....'....$..,>Eh._AJ".$Q%6....@}DPq8..J.5.C.(7.Ya.@..\|..p-..9...^.d.uo....J.../....c.mQ\G..].u.!V.w7l.yO..M.@^H..RY.n.s..\&F

C:\Users\user\AppData\Roaming\uTorrent\app.1612039849.tmp Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	PC bitmap, Windows 3.x format, 256 x 16 x 32
Category:	dropped
Size (bytes):	23846
Entropy (8bit):	5.869600821179163
Encrypted:	false
SSDEEP:
MD5:	F750057931614EA09A2C3659245586AA
SHA1:	3916AE9DE05D66499CD9892C54B9C737CC909D58
SHA-256:	68CFB8B18807B28E5E8C322B6F9E70B5BF0B601FDE9E6CF1F457634311FC0403
SHA-512:	4B91E9DD586D58281CFEE196EF4EDEB4CDED328A4B7A1C23F426E056EFEE025E338D96C011173A54A4444E285529D21E08BC2672432984E32E4DD08F58ADFAB1
Malicious:	false
Preview:	BM8@......6...(............. ......@.............................................%...<...;...&...................................................%...<...;...&...................................................%...<...;...&...................................................%...<...;...&...................................................%...<...;...&...................................................%...<...;...&...................................................%...<...;...&...................................................%...<...;...&...................................................%...<...;...&...................................................%...<...;...&...................................................%...<...;...&...................................................%...<...;...&...................................................%...<...;...&..........................................................)..............................................................)..............

C:\Users\user\AppData\Roaming\uTorrent\apps\player.btapp Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Preview:

C:\Users\user\AppData\Roaming\uTorrent\chrome_native.json Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Preview:

C:\Users\user\AppData\Roaming\uTorrent\dlimagecache\21403779564BD2E3A33023568D7B75FDBEB7E284 Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	empty
Category:	modified
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Preview:

C:\Users\user\AppData\Roaming\uTorrent\helper\is-7VLBM.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.9280948128891815
Encrypted:	false
SSDEEP:
MD5:	D57C362EBA99544164A69839551430A9
SHA1:	30B39FC360B41F1675EA6822F4307DA893B075A1
SHA-256:	9DA29EFEB24554FB8E4BF9464E7FF9AA1A13430E335BB4EC21B047024063F658
SHA-512:	9C6E32F4E61994E1B076E49DC8A7312EFABDCC7AE2A8EBB02B9FCE3EFB396D0AE6C9C9E2614CD79A9BBD18DCAFE81839BF57781C020706226D26AEA1870231F8
Malicious:	false
Preview:	update_url:http://btinstall-artifacts.bittorrent.com/helper/helper.btinstall..update_url_btinstall:http://btinstall-artifacts.bittorrent.com/helper/helper.btinstall..publisher:BitTorrent Inc...release_date:21/04/2020..version:276..description:Helper..product_code:{A284096A-FA3F-4008-B977-D29EC2503BEF}..signer:BitTorrent Inc...install_dir:helper..pretty_name:helper..process_name:helper.exe....

C:\Users\user\AppData\Roaming\uTorrent\helper\is-BI8E7.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.9280948128891815
Encrypted:	false
SSDEEP:
MD5:	D57C362EBA99544164A69839551430A9
SHA1:	30B39FC360B41F1675EA6822F4307DA893B075A1
SHA-256:	9DA29EFEB24554FB8E4BF9464E7FF9AA1A13430E335BB4EC21B047024063F658
SHA-512:	9C6E32F4E61994E1B076E49DC8A7312EFABDCC7AE2A8EBB02B9FCE3EFB396D0AE6C9C9E2614CD79A9BBD18DCAFE81839BF57781C020706226D26AEA1870231F8
Malicious:	false
Preview:	update_url:http://btinstall-artifacts.bittorrent.com/helper/helper.btinstall..update_url_btinstall:http://btinstall-artifacts.bittorrent.com/helper/helper.btinstall..publisher:BitTorrent Inc...release_date:21/04/2020..version:276..description:Helper..product_code:{A284096A-FA3F-4008-B977-D29EC2503BEF}..signer:BitTorrent Inc...install_dir:helper..pretty_name:helper..process_name:helper.exe....

C:\Users\user\AppData\Roaming\uTorrent\helper\is-ET7D6.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5032664
Entropy (8bit):	6.788279680423843
Encrypted:	false
SSDEEP:
MD5:	608CE7B25A0EA836ED02958A3748705B
SHA1:	2D93388C77A68D48522A9CF3999E047D755AFCD4
SHA-256:	A8E7A47B7F7749BD760AB291F7140A5C59718895A46A9D1F5E5695599955A191
SHA-512:	14FAF3ED365E377614AFC28124BE39A36654DEBDCF0EE882EBA2C33FA144A46F541338B26B77C50F0AC28B65EDC0D42CE248368D454D3154E8FFEEB9CF6B4AC5
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........u....W...W...W...V...W...V..W...V...Wmc.W...W...V...W...Vv..W...V...W...V...W...V...W...W...We..V...We..V...We..V...We..W...W..W...We..V...WRich...W................PE..L....7._.................l5...................5...@..........................@M......L...@..................................&G.......I.`.............L..:....J..7....C.T.....................C.....X.C.@.............5..............................text....j5......l5................. ..`.rdata........5......p5.............@..@.data........PG.. ...2G.............@....rsrc...`.....I......RI.............@..@.reloc...7....J..8...XI.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uTorrent\helper\is-LK0VG.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5032664
Entropy (8bit):	6.788279680423843
Encrypted:	false
SSDEEP:
MD5:	608CE7B25A0EA836ED02958A3748705B
SHA1:	2D93388C77A68D48522A9CF3999E047D755AFCD4
SHA-256:	A8E7A47B7F7749BD760AB291F7140A5C59718895A46A9D1F5E5695599955A191
SHA-512:	14FAF3ED365E377614AFC28124BE39A36654DEBDCF0EE882EBA2C33FA144A46F541338B26B77C50F0AC28B65EDC0D42CE248368D454D3154E8FFEEB9CF6B4AC5
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........u....W...W...W...V...W...V..W...V...Wmc.W...W...V...W...Vv..W...V...W...V...W...V...W...W...We..V...We..V...We..V...We..W...W..W...We..V...WRich...W................PE..L....7._.................l5...................5...@..........................@M......L...@..................................&G.......I.`.............L..:....J..7....C.T.....................C.....X.C.@.............5..............................text....j5......l5................. ..`.rdata........5......p5.............@..@.data........PG.. ...2G.............@....rsrc...`.....I......RI.............@..@.reloc...7....J..8...XI.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uTorrent\helper_web_ui.btinstall Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Preview:

C:\Users\user\AppData\Roaming\uTorrent\is-13VVS.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	372530
Entropy (8bit):	7.95369869732973
Encrypted:	false
SSDEEP:
MD5:	C32F0C6DBC46362C933D74D0CB1519AC
SHA1:	D73753D3569578E7F4328384C7164F063439F969
SHA-256:	36E43826CEC9E1AAE980E26D4BAB33546484BE8393F1CBEB8E89C5555E9BBA22
SHA-512:	118CC08BD804296D96F259F84380D571D4B62650E4836388C3F7AF731418703FAB6EDCEC6CB2123F1C55E07283D2719506D96196E8DF5CCEBFDABAA3793E1905
Malicious:	false
Preview:	ITSF....`........I.r.......\|.{.......".....\|.{......."..`...............x.......T0.......0..............2...............ITSP....T...........................................j..].!......."..T...............PMGL>................/..../#IDXHDR...W.../#ITBITS..../#STRINGS.....7./#SYSTEM....(./#TOCIDX...W.P./#TOPICS...'.0./#URLSTR...;._./#URLTBL...W.d./#WINDOWS...O.L./$FIftiMain...b..u./$OBJINST...#.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....../$WWKeywordLinks/..../$WWKeywordLinks/Property....../html/..../html/AppendixA.html...;.../html/AppendixA_01.html...Y.../html/AppendixA_01_01.html...].A./html/AppendixA_01_02.html.....y./html/AppendixA_01_03.html.....#./html/AppendixA_01_04.html...:..../html/AppendixA_01_05.html...=.../html/AppendixA_01_05_01.html...D.~./html/AppendixA_01_05_02.html...B.U./html/AppendixA_01_05_03.html.....V./html/AppendixA_01_05_04.html...m.../html/AppendixA_01_05_05.html......./html/AppendixA_01_05_06.html......./html/AppendixA_01_05_07.html...%.C./html

C:\Users\user\AppData\Roaming\uTorrent\is-17AQF.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
File Type:	Zip archive data, at least v1.0 to extract
Category:	dropped
Size (bytes):	1345409
Entropy (8bit):	7.999059234730361
Encrypted:	true
SSDEEP:
MD5:	80E85E634B7772686655F1BE930DA07D
SHA1:	33327E9006450EAC668BB72653F886AC304B1FED
SHA-256:	7B879AA4253676A4D7CB3F5D5DD1AF93F8D2756276DE72130AEC06FE96828ED5
SHA-512:	E2DF3E2F41C5410642F0CC91052B9E016FFDE7755A5FCA6F2B17640446260E5F4953F564E6B2DE20E74632078D87DE47B3D4FEC34E3ECCA7FA1475CEC8AE3270
Malicious:	false
Preview:	PK.........".P`7.:.Y..........Serbian (Latin)!srYU.txt.[s..........(.j.HP.Z..b..).".4......j..Y.K........<..=s"....L.eb.e..5.p..#.P.._....0.[k.KV.@.}9~.>."s......[..?.......O..#.....!...w.L.._.I.l.....gf../...............iZ._;..F.^_.........iu.....d/.?/.S..89J...L.li.........d.29.....T..L..=\|...N>.. ..."..q:.IZ...3.=5i..N.}[%&).Y..n.xK.'....-.694?.-=7...y..<J......b.....j@C..i._.k.....3....<O&&.HL.Jg.J.v.N.Q.m2.......t..E...O..u.tM...."....~.U...)i.e..c.<..'..E.NN....I...h...K..,&5z...pli0.M...?8zef.c\|b%...7.....>.&;1U2.....;<....d...D.......z..8.._..-K..''.(.p..0...:.....fie.!.M......3...<.g9=.q.Mv..vi..D_.,...M.......Y_Kn.V)...K.QM...g.p'...vB7.].a.'...O$#3.N..L.W.6Y'../...3..N...&..3Sv..n.........x.........k...IF..NJj#=P.,.y.W.4.!.I/..nJc....<l..9.f......mR.^Z.2..........E.0........\=.=..-.......\_...aH.~F.l.L.+.fn...,}.KK$<.Q./......<.....l.G..h..i.ec.nZ..5S......s..9y..Y.....0..5...-.....o......i....wI...YUA...

C:\Users\user\AppData\Roaming\uTorrent\is-22O6M.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	Zip archive data, at least v1.0 to extract
Category:	dropped
Size (bytes):	1345409
Entropy (8bit):	7.999059234730361
Encrypted:	true
SSDEEP:
MD5:	80E85E634B7772686655F1BE930DA07D
SHA1:	33327E9006450EAC668BB72653F886AC304B1FED
SHA-256:	7B879AA4253676A4D7CB3F5D5DD1AF93F8D2756276DE72130AEC06FE96828ED5
SHA-512:	E2DF3E2F41C5410642F0CC91052B9E016FFDE7755A5FCA6F2B17640446260E5F4953F564E6B2DE20E74632078D87DE47B3D4FEC34E3ECCA7FA1475CEC8AE3270
Malicious:	false
Preview:	PK.........".P`7.:.Y..........Serbian (Latin)!srYU.txt.[s..........(.j.HP.Z..b..).".4......j..Y.K........<..=s"....L.eb.e..5.p..#.P.._....0.[k.KV.@.}9~.>."s......[..?.......O..#.....!...w.L.._.I.l.....gf../...............iZ._;..F.^_.........iu.....d/.?/.S..89J...L.li.........d.29.....T..L..=\|...N>.. ..."..q:.IZ...3.=5i..N.}[%&).Y..n.xK.'....-.694?.-=7...y..<J......b.....j@C..i._.k.....3....<O&&.HL.Jg.J.v.N.Q.m2.......t..E...O..u.tM...."....~.U...)i.e..c.<..'..E.NN....I...h...K..,&5z...pli0.M...?8zef.c\|b%...7.....>.&;1U2.....;<....d...D.......z..8.._..-K..''.(.p..0...:.....fie.!.M......3...<.g9=.q.Mv..vi..D_.,...M.......Y_Kn.V)...K.QM...g.p'...vB7.].a.'...O$#3.N..L.W.6Y'../...3..N...&..3Sv..n.........x.........k...IF..NJj#=P.,.y.W.4.!.I/..nJc....<l..9.f......mR.^Z.2..........E.0........\=.=..-.......\_...aH.~F.l.L.+.fn...,}.KK$<.Q./......<.....l.G..h..i.ec.nZ..5S......s..9y..Y.....0..5...-.....o......i....wI...YUA...

C:\Users\user\AppData\Roaming\uTorrent\is-2J5EN.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	157506
Entropy (8bit):	4.970088559789926
Encrypted:	false
SSDEEP:
MD5:	B45CA5D0EE1707B376F7A66471713379
SHA1:	0A3F2B33962D310B0EFA40CA79617154D042FFC4
SHA-256:	2C31A8C896428B20748FE3590385FECD126135D2338B8B1F2207AE6C5E0DC2B0
SHA-512:	F23633D40A53683427A1EBC369D79B8AD9DF06825409F0B538B8CC2D4254FA6EFED537F0C3FE80713E45827256477F5927686C0F4AC9FF83DE5218E2EEE39D99
Malicious:	false
Preview:	# Last Update: 2020-12-02, V223.a..# by schnurlos..# UPDATE: you need also the latest flags.bmp to see the new added..# flags from 2020-09-20: BL, MF!!!..# outdated: AN (but still valid), TP (removed)..# Howto: http://www.should.keepfree.de/Readme_FLAGS.html..# Download: http://www.should.keepfree.de/flags.conf..# Use with: http://www.should.keepfree.de/flags.bmp..# ..# #########################..# # incl. US MAPPINGS !!! #..# #########################..# ..# ..# To add new hostnames: http://forum.utorrent.com/topic/1820-flags/..# ..# TLDs in bitmap..00..AC AD AE AF AG AI AL AM AN AO AQ AR AS AT AU AW AX AZ..BA BB BD BE BF BG BH BI BJ BL BM BN BO BR BS BT BV BW BY BZ..CA CC CD CF CG CH CI CK CL CM CN CO CR CU CV CW CX CY CZ..DE DJ DK DM DO DZ..EC EE EG EH ER ES ET EU..FI FJ FK FM FO FR..GA GB GD GE GF GG GH GI GL GM GN GP GQ GR GS GT GU GW GY..HK HM HN HR HT HU..ID IE IL IM IN IO IQ IR IS IT..JE JM JO JP..KE KG KH KI KM KN KP KR KW KY KZ..LA LB LC LI LK LR LS L

C:\Users\user\AppData\Roaming\uTorrent\is-4E9CU.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	157506
Entropy (8bit):	4.970088559789926
Encrypted:	false
SSDEEP:
MD5:	B45CA5D0EE1707B376F7A66471713379
SHA1:	0A3F2B33962D310B0EFA40CA79617154D042FFC4
SHA-256:	2C31A8C896428B20748FE3590385FECD126135D2338B8B1F2207AE6C5E0DC2B0
SHA-512:	F23633D40A53683427A1EBC369D79B8AD9DF06825409F0B538B8CC2D4254FA6EFED537F0C3FE80713E45827256477F5927686C0F4AC9FF83DE5218E2EEE39D99
Malicious:	false
Preview:	# Last Update: 2020-12-02, V223.a..# by schnurlos..# UPDATE: you need also the latest flags.bmp to see the new added..# flags from 2020-09-20: BL, MF!!!..# outdated: AN (but still valid), TP (removed)..# Howto: http://www.should.keepfree.de/Readme_FLAGS.html..# Download: http://www.should.keepfree.de/flags.conf..# Use with: http://www.should.keepfree.de/flags.bmp..# ..# #########################..# # incl. US MAPPINGS !!! #..# #########################..# ..# ..# To add new hostnames: http://forum.utorrent.com/topic/1820-flags/..# ..# TLDs in bitmap..00..AC AD AE AF AG AI AL AM AN AO AQ AR AS AT AU AW AX AZ..BA BB BD BE BF BG BH BI BJ BL BM BN BO BR BS BT BV BW BY BZ..CA CC CD CF CG CH CI CK CL CM CN CO CR CU CV CW CX CY CZ..DE DJ DK DM DO DZ..EC EE EG EH ER ES ET EU..FI FJ FK FM FO FR..GA GB GD GE GF GG GH GI GL GM GN GP GQ GR GS GT GU GW GY..HK HM HN HR HT HU..ID IE IL IM IN IO IQ IR IS IT..JE JM JO JP..KE KG KH KI KM KN KP KR KW KY KZ..LA LB LC LI LK LR LS L

C:\Users\user\AppData\Roaming\uTorrent\is-5I7V3.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	372530
Entropy (8bit):	7.95369869732973
Encrypted:	false
SSDEEP:
MD5:	C32F0C6DBC46362C933D74D0CB1519AC
SHA1:	D73753D3569578E7F4328384C7164F063439F969
SHA-256:	36E43826CEC9E1AAE980E26D4BAB33546484BE8393F1CBEB8E89C5555E9BBA22
SHA-512:	118CC08BD804296D96F259F84380D571D4B62650E4836388C3F7AF731418703FAB6EDCEC6CB2123F1C55E07283D2719506D96196E8DF5CCEBFDABAA3793E1905
Malicious:	false
Preview:	ITSF....`........I.r.......\|.{.......".....\|.{......."..`...............x.......T0.......0..............2...............ITSP....T...........................................j..].!......."..T...............PMGL>................/..../#IDXHDR...W.../#ITBITS..../#STRINGS.....7./#SYSTEM....(./#TOCIDX...W.P./#TOPICS...'.0./#URLSTR...;._./#URLTBL...W.d./#WINDOWS...O.L./$FIftiMain...b..u./$OBJINST...#.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....../$WWKeywordLinks/..../$WWKeywordLinks/Property....../html/..../html/AppendixA.html...;.../html/AppendixA_01.html...Y.../html/AppendixA_01_01.html...].A./html/AppendixA_01_02.html.....y./html/AppendixA_01_03.html.....#./html/AppendixA_01_04.html...:..../html/AppendixA_01_05.html...=.../html/AppendixA_01_05_01.html...D.~./html/AppendixA_01_05_02.html...B.U./html/AppendixA_01_05_03.html.....V./html/AppendixA_01_05_04.html...m.../html/AppendixA_01_05_05.html......./html/AppendixA_01_05_06.html......./html/AppendixA_01_05_07.html...%.C./html

C:\Users\user\AppData\Roaming\uTorrent\is-87BJR.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2312248
Entropy (8bit):	7.990123521051925
Encrypted:	true
SSDEEP:
MD5:	63A21714686DE67930538F0E12036B8B
SHA1:	2DF8E8C43E538CF9E4B38C1670E2700A7FBA7DC0
SHA-256:	A3CBA8C7AE3386CFA3DC3806A312B4011FE8857B137E681F1F481DFAD8D43CEC
SHA-512:	C9D8E251D71006E46551A147A2D3FC71AD97513FF38A7619F5CDFDB9F55B445154108E719AFB511F9931AEE819030FD2126F880FB91EA87411D2A45914D4C5AF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..g...g...g...n.`.r...g.......y.f.a...n.p.n...n.w.B...n.a.f...n.g.f...n.b.f...Richg...........PE..L......M.....................:....................@..........................@........#.................................3...............x@..........H.#..4...........................................................................................text...K........................... ..`.rdata..u...........................@..@.data...............................@....CRT................................@..@.rsrc...x@.......B..................@..@........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uTorrent\is-8L18J.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2312248
Entropy (8bit):	7.990123521051925
Encrypted:	true
SSDEEP:
MD5:	63A21714686DE67930538F0E12036B8B
SHA1:	2DF8E8C43E538CF9E4B38C1670E2700A7FBA7DC0
SHA-256:	A3CBA8C7AE3386CFA3DC3806A312B4011FE8857B137E681F1F481DFAD8D43CEC
SHA-512:	C9D8E251D71006E46551A147A2D3FC71AD97513FF38A7619F5CDFDB9F55B445154108E719AFB511F9931AEE819030FD2126F880FB91EA87411D2A45914D4C5AF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..g...g...g...n.`.r...g.......y.f.a...n.p.n...n.w.B...n.a.f...n.g.f...n.b.f...Richg...........PE..L......M.....................:....................@..........................@........#.................................3...............x@..........H.#..4...........................................................................................text...K........................... ..`.rdata..u...........................@..@.data...............................@....CRT................................@..@.rsrc...x@.......B..................@..@........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uTorrent\is-9NG7Q.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	MS Windows icon resource - 3 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
Category:	dropped
Size (bytes):	7406
Entropy (8bit):	4.598253112281285
Encrypted:	false
SSDEEP:
MD5:	CFECC8C743FF84353D95D1EB25D71B42
SHA1:	698EA5628F492452BE7D23FC26015387B0414ED6
SHA-256:	BBEF68AEC2D0588FCFE4578D6D5D27B2C3FAB0A29AE24FED98811C858378D77B
SHA-512:	28EE481DCAE4204FAA69B3FF9B63EC39D14F69DD270F07276D50DF14D177578EBCEC8D7F126C92FFB6D04AE50D707A643DE7773970C1F55E3E38C8B1E3CCF995
Malicious:	false
Preview:	......00..........6... ......................h.......(...0...`.......................................................................yf...\|.......x...}...H..........*..r........+...F...8............... ..........}................L.............@...`...........#.......0.......z...=... .......o................\|....c..{..............c..............u....c.......c.......c.......c...........W..........."...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uTorrent\is-AVBP3.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2146776
Entropy (8bit):	7.984955432046909
Encrypted:	false
SSDEEP:
MD5:	4939D280485BDC0AC67B49012BDCEC08
SHA1:	FC7D1D37B82E126D999AC8A6C5C9343363925FE6
SHA-256:	30B6A34230E15D9941FD4D37FE392C3306C8EF4C1DE59C5C87D80068514565DF
SHA-512:	6A175D3F71D7430479B7E21B92DB07F1758A9EA63A341375107BB002DF4CBFE90031A04705B560A130CE02E9EAE1B51C189D93A864B0F253CDFC03AE652B1868
Malicious:	false
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......... ...s...s...s.6Fs...s.6Dsf..s.6Es...sE.r...s>.ps...s...r...s...r..s...r...sH..s...s#..s...s7..r...s7..rk..s..4s...s..3s...s..$s...s...sV..s7..r!..s2.Hs...s.. s...s7..r...sRich...s........................PE..L......_.........................07...U..@7...U...@...........................W......$!......................................W.......U..............x ..I....................................U.....,.U.\...........................................UPX0.....07.............................UPX1.........@7.....................@....rsrc.........U.....................@..............................................................................................................................................................................................................................................................................................3.00.UPX!....

C:\Users\user\AppData\Roaming\uTorrent\is-CT260.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	PC bitmap, Windows 3.x format, 4064 x 16 x 24
Category:	dropped
Size (bytes):	195126
Entropy (8bit):	3.046846095725388
Encrypted:	false
SSDEEP:
MD5:	FC81728512003BFE92D66A49202A98E4
SHA1:	1771BC0542261E1BB4A8F1FB5B0F1D498E02E8BB
SHA-256:	67C035AADF04108C8793851E07C5E1BD0C724646ADAEB2242B015DAE55669046
SHA-512:	8BA4DCBAF2297DCEDC17A66C122D9DF6737B6B710CB933E50F6D8266953758093E278468ED8DE11CB8DFDBCB79423BF444CEA9CFF269FB20BC3E70AE9C523608
Malicious:	false
Preview:	BM6.......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uTorrent\is-DSSNR.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	35749
Entropy (8bit):	7.967701083143022
Encrypted:	false
SSDEEP:
MD5:	341385C9F53163F68C0FBA11344BDE43
SHA1:	0757DCCBB2DF7E4566F7FCAF4C7E4AAA72575F65
SHA-256:	7DA8E5F181F9EF4CBEC372C81B6280E920CF774CB2B309446353FDB3F61DC2C7
SHA-512:	9AC062B6CBF65DEF8281C7646C54970689E03BC0C0D0C472165ADDDFFDFE70412DE6593445D6E0DC3BEC52947E86CA40B056E4F2D5C234019593CBA3587B31F3
Malicious:	false
Preview:	PK........fY!IU.:F....H.......btskin}V]r. .~.L...t..-.m.kh.ZIL1....... .,;h....].w.U+.f.f..\]..~;.\|...V..p>. :......./.....5...\1$..X[..?....Q4..I.AsG..Z.q......5..'}..Z....6....a......_?...aW...__....?.J..d...6......R.=W.......>...P..QB..u...n9..jM....~........3.+.;.S..N...-s.;..\...s.^LM......D.-...Z..d&kL...m..Dt........-.b...bF.Q4.%.Y:.D..A."^..p....P.A.>b..,.....o.v..4zQ".=..#..b..b.R..G.T.$7E..J.(.+..0..o8J...2.T..36.d...=(..l..Q....h..X.g..4.RcN...zdH~.`.C.a...*Zq..."..qz?Y.[....e>...(.T.S0...\|.B...}Oc&....a;...4)...r.q.a.C...a...4...Q....9...:.._....v.z/..X..Sw.+[..D+........p.u.O#-}..e.X..L....]..U ;+....s....B.....V.A0.......{Zc..>.....5.r.x..i.Tj1..w.O2^.....B..[..<..Mf...p".....2Z.\|...q.^f...JM..l.b8.2..-x...7gT..p...~V.q..Y...H..h........8.}.j...n.z.)F.RI..-......tg.....](..9I3.6.8....(..]y.jj.....$h..G.......])7r\6...3}.J.....5S...}F...t.=.......q3.K....\...w.pX8......o..>.r....~....!.:y:.+.n......PK........fY!IA\|.x............ico

C:\Users\user\AppData\Roaming\uTorrent\is-F8B05.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
File Type:	MS Windows icon resource - 3 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
Category:	dropped
Size (bytes):	7406
Entropy (8bit):	4.598253112281285
Encrypted:	false
SSDEEP:
MD5:	CFECC8C743FF84353D95D1EB25D71B42
SHA1:	698EA5628F492452BE7D23FC26015387B0414ED6
SHA-256:	BBEF68AEC2D0588FCFE4578D6D5D27B2C3FAB0A29AE24FED98811C858378D77B
SHA-512:	28EE481DCAE4204FAA69B3FF9B63EC39D14F69DD270F07276D50DF14D177578EBCEC8D7F126C92FFB6D04AE50D707A643DE7773970C1F55E3E38C8B1E3CCF995
Malicious:	false
Preview:	......00..........6... ......................h.......(...0...`.......................................................................yf...\|.......x...}...H..........*..r........+...F...8............... ..........}................L.............@...`...........#.......0.......z...=... .......o................\|....c..{..............c..............u....c.......c.......c.......c...........W..........."...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uTorrent\is-HPHMO.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
File Type:	data
Category:	dropped
Size (bytes):	17134
Entropy (8bit):	5.016944393191676
Encrypted:	false
SSDEEP:
MD5:	A3946A20D02DCD076BE66EDAEB75DF51
SHA1:	718D2EE55A0F17283C2F0FF20520C4A5A44F1412
SHA-256:	93925C9D0704C7A02D05BDF8F1430CFC9A72E53B54F589D92FE7F1F6493FD5A4
SHA-512:	6316AB836E0EEA3A9FEDA65AD652F143CCC2F06D45866343660AAAA1E7E1E905D58019FB62974457C0AE08EA51EC3F492797D589847376CAAF31FD4864AFAE94
Malicious:	false
Preview:	d15:add_dialog_histle9:addpreloc8:{.......9:addprewnd8:........17:addprewndexpandedi1e8:anoninfoi0e4:appsd7:applistld22:btinstall_lastmodified0:12:lastmodified0:4:path6:helpereee4:asszi0e38:attempted_to_receive_server_search_urli1e9:autostarti0e3:av28:........13:benchrecorderde10:bin_changei13227404232e7:born_oni13227404226e14:born_on_remotei0e15:bt.enable_pulsei0e13:campaign_codei290e7:cfu_seqi6e20:check_assoc_on_starti0e12:check_updatei0e17:check_update_betai0e13:close_to_trayi0e7:cold_oni0e7:ct_histle19:daily_download_hist248:<.......................................................................................................................................................................................................................................................25:daily_local_download_hist248:.........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uTorrent\is-JP462.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1415031
Entropy (8bit):	6.483649183477566
Encrypted:	false
SSDEEP:
MD5:	2CD3F9345F055BB6821A4D9A6C0E4CF5
SHA1:	32191067AEF097171389978937AF74C6529F5615
SHA-256:	C99B73BA942290D1D7584FAAD83C8127E86A2CAE5D518ADFFCC1036BA33A577C
SHA-512:	F6933AFE39C64FE4847D64727B8A16A9740CC00BA3053D4DC429DEA587471E180C415182A50B1294C20A605E3FF274B882481818E38B3170C462495028442363
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...Rm"[.....................$.......%.......0....@.......................................@......@..............................@8...@......................................................0.......................................................text............................... ..`.itext.............................. ..`.data....0...0...2..................@....bss.....a...p.......L...................idata..@8.......:...L..............@....tls....<.... ...........................rdata.......0......................@..@.rsrc.......@......................@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Roaming\uTorrent\is-N5OCA.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2146776
Entropy (8bit):	7.984955432046909
Encrypted:	false
SSDEEP:
MD5:	4939D280485BDC0AC67B49012BDCEC08
SHA1:	FC7D1D37B82E126D999AC8A6C5C9343363925FE6
SHA-256:	30B6A34230E15D9941FD4D37FE392C3306C8EF4C1DE59C5C87D80068514565DF
SHA-512:	6A175D3F71D7430479B7E21B92DB07F1758A9EA63A341375107BB002DF4CBFE90031A04705B560A130CE02E9EAE1B51C189D93A864B0F253CDFC03AE652B1868
Malicious:	false
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......... ...s...s...s.6Fs...s.6Dsf..s.6Es...sE.r...s>.ps...s...r...s...r..s...r...sH..s...s#..s...s7..r...s7..rk..s..4s...s..3s...s..$s...s...sV..s7..r!..s2.Hs...s.. s...s7..r...sRich...s........................PE..L......_.........................07...U..@7...U...@...........................W......$!......................................W.......U..............x ..I....................................U.....,.U.\...........................................UPX0.....07.............................UPX1.........@7.....................@....rsrc.........U.....................@..............................................................................................................................................................................................................................................................................................3.00.UPX!....

C:\Users\user\AppData\Roaming\uTorrent\is-NM9TH.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	35749
Entropy (8bit):	7.967701083143022
Encrypted:	false
SSDEEP:
MD5:	341385C9F53163F68C0FBA11344BDE43
SHA1:	0757DCCBB2DF7E4566F7FCAF4C7E4AAA72575F65
SHA-256:	7DA8E5F181F9EF4CBEC372C81B6280E920CF774CB2B309446353FDB3F61DC2C7
SHA-512:	9AC062B6CBF65DEF8281C7646C54970689E03BC0C0D0C472165ADDDFFDFE70412DE6593445D6E0DC3BEC52947E86CA40B056E4F2D5C234019593CBA3587B31F3
Malicious:	false
Preview:	PK........fY!IU.:F....H.......btskin}V]r. .~.L...t..-.m.kh.ZIL1....... .,;h....].w.U+.f.f..\]..~;.\|...V..p>. :......./.....5...\1$..X[..?....Q4..I.AsG..Z.q......5..'}..Z....6....a......_?...aW...__....?.J..d...6......R.=W.......>...P..QB..u...n9..jM....~........3.+.;.S..N...-s.;..\...s.^LM......D.-...Z..d&kL...m..Dt........-.b...bF.Q4.%.Y:.D..A."^..p....P.A.>b..,.....o.v..4zQ".=..#..b..b.R..G.T.$7E..J.(.+..0..o8J...2.T..36.d...=(..l..Q....h..X.g..4.RcN...zdH~.`.C.a...*Zq..."..qz?Y.[....e>...(.T.S0...\|.B...}Oc&....a;...4)...r.q.a.C...a...4...Q....9...:.._....v.z/..X..Sw.+[..D+........p.u.O#-}..e.X..L....]..U ;+....s....B.....V.A0.......{Zc..>.....5.r.x..i.Tj1..w.O2^.....B..[..<..Mf...p".....2Z.\|...q.^f...JM..l.b8.2..-x...7gT..p...~V.q..Y...H..h........8.}.j...n.z.)F.RI..-......tg.....](..9I3.6.8....(..]y.jj.....$h..G.......])7r\6...3}.J.....5S...}F...t.=.......q3.K....\...w.pX8......o..>.r....~....!.:y:.+.n......PK........fY!IA\|.x............ico

C:\Users\user\AppData\Roaming\uTorrent\is-NRU4J.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
File Type:	PC bitmap, Windows 3.x format, 4064 x 16 x 24
Category:	dropped
Size (bytes):	195126
Entropy (8bit):	3.046846095725388
Encrypted:	false
SSDEEP:
MD5:	FC81728512003BFE92D66A49202A98E4
SHA1:	1771BC0542261E1BB4A8F1FB5B0F1D498E02E8BB
SHA-256:	67C035AADF04108C8793851E07C5E1BD0C724646ADAEB2242B015DAE55669046
SHA-512:	8BA4DCBAF2297DCEDC17A66C122D9DF6737B6B710CB933E50F6D8266953758093E278468ED8DE11CB8DFDBCB79423BF444CEA9CFF269FB20BC3E70AE9C523608
Malicious:	false
Preview:	BM6.......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uTorrent\is-UMDDA.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	data
Category:	dropped
Size (bytes):	17134
Entropy (8bit):	5.016944393191676
Encrypted:	false
SSDEEP:
MD5:	A3946A20D02DCD076BE66EDAEB75DF51
SHA1:	718D2EE55A0F17283C2F0FF20520C4A5A44F1412
SHA-256:	93925C9D0704C7A02D05BDF8F1430CFC9A72E53B54F589D92FE7F1F6493FD5A4
SHA-512:	6316AB836E0EEA3A9FEDA65AD652F143CCC2F06D45866343660AAAA1E7E1E905D58019FB62974457C0AE08EA51EC3F492797D589847376CAAF31FD4864AFAE94
Malicious:	false
Preview:	d15:add_dialog_histle9:addpreloc8:{.......9:addprewnd8:........17:addprewndexpandedi1e8:anoninfoi0e4:appsd7:applistld22:btinstall_lastmodified0:12:lastmodified0:4:path6:helpereee4:asszi0e38:attempted_to_receive_server_search_urli1e9:autostarti0e3:av28:........13:benchrecorderde10:bin_changei13227404232e7:born_oni13227404226e14:born_on_remotei0e15:bt.enable_pulsei0e13:campaign_codei290e7:cfu_seqi6e20:check_assoc_on_starti0e12:check_updatei0e17:check_update_betai0e13:close_to_trayi0e7:cold_oni0e7:ct_histle19:daily_download_hist248:<.......................................................................................................................................................................................................................................................25:daily_local_download_hist248:.........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uTorrent\is-VGHOK.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1415031
Entropy (8bit):	6.483649183477566
Encrypted:	false
SSDEEP:
MD5:	2CD3F9345F055BB6821A4D9A6C0E4CF5
SHA1:	32191067AEF097171389978937AF74C6529F5615
SHA-256:	C99B73BA942290D1D7584FAAD83C8127E86A2CAE5D518ADFFCC1036BA33A577C
SHA-512:	F6933AFE39C64FE4847D64727B8A16A9740CC00BA3053D4DC429DEA587471E180C415182A50B1294C20A605E3FF274B882481818E38B3170C462495028442363
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...Rm"[.....................$.......%.......0....@.......................................@......@..............................@8...@......................................................0.......................................................text............................... ..`.itext.............................. ..`.data....0...0...2..................@....bss.....a...p.......L...................idata..@8.......:...L..............@....tls....<.... ...........................rdata.......0......................@..@.rsrc.......@......................@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Roaming\uTorrent\maindoc.ico Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Preview:

C:\Users\user\AppData\Roaming\uTorrent\settings.dat.new Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	data
Category:	dropped
Size (bytes):	38730
Entropy (8bit):	5.557109726702994
Encrypted:	false
SSDEEP:
MD5:	56F10634D4BB810396272A72390C2D7B
SHA1:	B9DF44652457A9D376F3632B4D4E90D7A797C8CE
SHA-256:	F2B044708E0DAA0D3F84D8D51B3DE27CB3C55B2F1B8C8E84F4140FC064D7508A
SHA-512:	EDAE2E71FE65F4653A28FE5E6CBC36AE35D1DCD6D25D9AF37B2D6861C6AB59263EA8136C63073242022C51A46FD8BDDC54EB9BBE25E1C8DFA85FF0AEAB203161
Malicious:	false
Preview:	d10:.fileguard40:90FB591E7316B86BCDBEAD9354B833C4AA75D75515:add_dialog_histle9:addpreloc8:{.......9:addprewnd8:........17:addprewndexpandedi1e8:anoninfoi0e4:appsd7:applistld22:btinstall_lastmodified0:12:lastmodified0:4:path6:helpereee4:asszi0e38:attempted_to_receive_server_search_urli1e9:autostarti0e3:av28:........13:benchrecorderde10:bin_changei13227404232e7:born_oni13227404226e14:born_on_remotei0e15:bt.enable_pulsei0e15:btapps.skin_url8:user_set13:campaign_codei290e7:cfu_seqi6e20:check_assoc_on_starti0e12:check_updatei0e17:check_update_betai0e3:cid24:~...i.C.&8.K.JT..L .N<.4:cids28:~...i.C.&8.K.JT..L .N<....`13:close_to_trayi0e7:cold_oni0e7:ct_histle19:daily_download_hist248:........................................................................................................................................................................................................................................................25:daily_local_download_hist248:................................

C:\Users\user\AppData\Roaming\uTorrent\unins000.dat Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	data
Category:	dropped
Size (bytes):	16628
Entropy (8bit):	3.9454770939311916
Encrypted:	false
SSDEEP:
MD5:	F4FF50F49C8D9D05067AD90CA211A9E0
SHA1:	065BFE94413EA166D69F44A598A5915F3ECAFE36
SHA-256:	1F5B6B4DCC996E24F48517E13861FDF0375E785F797D714D376C6E4BFF07CF45
SHA-512:	7340CE6E53A77D5BEAC573F3F303EF3093631BC8D2BEB758A98496DF7C7834773B8E16C19ED2F87A6927760A0ACD54224EAED5A45331594050E50AC5782C380D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................<P.................2.1.6.0.4.1......h.a.r.d.z......C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.u.T.o.r.r.e.n.t................1.).... .....\!.......IFPS....&..."...........................................................................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TNEWCHECKLISTBOX....TNEWCHECKLISTBOX.........TNEWBUTTON....TNEWBUTTON.........TSETUPMESSAGEID.........TMSGBOXTYPE.........TEXECWAIT.........TSETUPSTEP....

C:\Users\user\AppData\Roaming\uTorrent\updates.dat Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Preview:

C:\Users\user\AppData\Roaming\uTorrent\updates\3.5.5_45852.exe Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Preview:

C:\Users\user\AppData\Roaming\uTorrent\updates\3.5.5_45852\utorrentie.exe Download File
Process:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Preview:

C:\Windows\System32\drivers\etc\hosts Download File
Process:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	886
Entropy (8bit):	4.699779927068267
Encrypted:	false
SSDEEP:
MD5:	5B7B81607BD6CDD2E660B0E4F4574EC0
SHA1:	5AD9AE76BB574F65E88D3ACBF918C0B00E4D50DA
SHA-256:	F67F2CD1849BB9505568149B745092D2EAEFAF0708A4C371204D63F58F03022D
SHA-512:	493BE7AB7591E8FF6039BC719012FD7DF937E3305C9D85560C24BAF573060213ED9CA9AE0E635CA22F780D53527DDA207CAD72AC5C68E579CDA4F5544D685215
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost..0.0.0.0 cdn.ap.bittorrent.com..0.0.0.0 cdn.ap.bittorrent.com..

\Device\ConDrv Download File
Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.2359263506290326
Encrypted:	false
SSDEEP:
MD5:	F1CA165C0DA831C9A17D08C4DECBD114
SHA1:	D750F8260312A40968458169B496C40DACC751CA
SHA-256:	ACCF036232D2570796BF0ABF71FFE342DC35E2F07B12041FE739D44A06F36AF8
SHA-512:	052FF09612F382505B049EF15D9FB83E46430B5EE4EEFB0F865CD1A3A50FDFA6FFF573E0EF940F26E955270502D5774187CD88B90CD53792AC1F6DFA37E4B646
Malicious:	false
Preview:	Ok.....

Static File Info

General
File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.990378557794406
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	yVn2ywuhEC.exe
File size:	32864256
MD5:	fa9649ba7f76190701b2f1ffaaf4d0df
SHA1:	dac66a285e89ee98cb84488df21f8c43c4acb5d3
SHA256:	772c627fc0b70e0454ff2e5464b9ee713a44a35298deba43f420e4fd21a0aeae
SHA512:	9868a1cc7e9bf361c1d93bad871b88fae0f3c3fa1f15dce1d386f1e78fbda913d30ffd3d407706a34043357727e7db560924ffbd7e1ec4bc5dada7c9e74f6c11
SSDEEP:	786432:R7y7AabxdnURprN3BaWEVYPZ8D55V+qE/PO3eF9xh8Gs2ZU9eiWY:R7yElrN0Wq0ZK5v7eF9x+y6
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...ES.`.........."..........n.................@..........................................`........................................

File Icon


Icon Hash:	646464e4d4044c0c

Static PE Info

General
Entrypoint:	0x1400809c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x60055345 [Mon Jan 18 09:22:13 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	47213d103768327f1ec64ab08cacc584

Entrypoint Preview

Instruction
inc eax
push edi
dec eax
sub esp, 000000D0h
mov ecx, 00000002h
call 00007F96C8B8D8A2h
mov dword ptr [01EBD76Bh], 00000000h
dec eax
lea eax, dword ptr [esp+34h]
dec eax
mov edi, eax
xor eax, eax
mov ecx, 00000004h
rep stosb
dec eax
mov dword ptr [esp+40h], 00000000h
call 00007F96C8B8D859h
dec eax
mov dword ptr [esp+48h], eax
call 00007F96C8B8D83Fh
dec eax
lea ecx, dword ptr [esp+34h]
dec eax
mov dword ptr [esp+20h], ecx
inc ebp
xor ecx, ecx
dec esp
lea eax, dword ptr [esp+40h]
dec eax
mov ecx, dword ptr [esp+48h]
dec eax
mov edx, ecx
dec eax
mov ecx, eax
call 00007F96C8B8D83Dh
dec eax
lea edx, dword ptr [00004821h]
dec eax
lea ecx, dword ptr [00004812h]
call 00007F96C8B8D84Ah
dec eax
lea edx, dword ptr [000047FEh]
dec eax
lea ecx, dword ptr [000047CFh]
call 00007F96C8B8D847h
dec eax
lea ecx, dword ptr [esp+60h]
call dword ptr [00005047h]
mov eax, dword ptr [esp+0000009Ch]
and eax, 01h
test eax, eax
je 00007F96C8B8CE30h
movzx eax, word ptr [esp+000000A0h]
mov dword ptr [esp+30h], eax
jmp 00007F96C8B8CE2Ah
mov dword ptr [esp+30h], 0000000Ah
mov eax, dword ptr [esp+30h]
mov dword ptr [esp+38h], eax
call dword ptr [0000006Dh]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85288	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1f4c000	0xee70	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1f3f000	0x6eac	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1f5b000	0x26a8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x851f0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x82ea0	0x108	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x857a0	0x4c8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x804c6	0x80600	False	0.429790195959	data	6.06972842736	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0x48f0	0x4a00	False	0.285103462838	data	4.2714543881	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x87000	0x1eb7a50	0x1eb7200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x1f3f000	0x6eac	0x7000	False	0.442034040179	data	5.4737097912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
._deh	0x1f46000	0x1360	0x1400	False	0.3109375	data	3.47460186172	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.dp	0x1f48000	0x218	0x400	False	0.255859375	data	3.17278788711	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.minfo	0x1f49000	0x2a0	0x400	False	0.1982421875	data	2.5250992228	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x1f4a000	0xbe8	0xc00	False	0.8408203125	data	7.128089035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tp	0x1f4b000	0x6c	0x200	False	0.14453125	data	0.854116102672	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1f4c000	0xee70	0xf000	False	0.121761067708	data	1.80371466415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1f5b000	0x26a8	0x2800	False	0.43466796875	data	5.42061574276	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1f4cae0	0x8028	dBase III DBT, version number 0, next free block index 40	English	United States
RT_ICON	0x1f54b08	0x2028	dBase III DBT, version number 0, next free block index 40	English	United States
RT_ICON	0x1f56b30	0x828	dBase III DBT, version number 0, next free block index 40	English	United States
RT_ICON	0x1f57358	0x25a8	data	English	United States
RT_ICON	0x1f59900	0x10a8	dBase III DBT, version number 0, next free block index 40	English	United States
RT_ICON	0x1f5a9a8	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_GROUP_ICON	0x1f5ae10	0x5a	data	English	United States
RT_VERSION	0x1f4c5e8	0x4f4	data	English	United States
RT_MANIFEST	0x1f4c220	0x3c3	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
MSVCR120.dll	__getmainargs, __iob_func, __p___argc, __p___argv, __set_app_type, _beginthreadex, _errno, _fdopen, _filbuf, _fileno, _flsbuf, _fputwc_nolock, _fseeki64, _ftelli64, _get_osfhandle, _initterm, _initterm_e, _localtime32, _lock_file, _set_output_format, _setmode, _tzset, _unlock_file, _vsnprintf, _wfopen, _wfreopen, abort, calloc, exit, fclose, feof, ferror, fflush, fopen, fprintf, fread, free, fwrite, getenv, isdigit, isspace, malloc, memcmp, memcpy, memmove, memset, printf, qsort, realloc, sscanf, strerror, strlen, strtod, toupper, wcscmp, wcslen
KERNEL32.dll	CloseHandle, CreateEventW, CreateProcessW, CreateSemaphoreA, CreateToolhelp32Snapshot, DeleteCriticalSection, DeleteFileW, DuplicateHandle, EnterCriticalSection, ExitProcess, ExpandEnvironmentStringsW, FindClose, FindFirstFileW, FindNextFileW, FormatMessageW, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetCommandLineA, GetConsoleOutputCP, GetConsoleScreenBufferInfo, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDiskFreeSpaceExW, GetDriveTypeW, GetEnvironmentStringsW, GetEnvironmentVariableA, GetEnvironmentVariableW, GetExitCodeThread, GetFileAttributesExW, GetFileAttributesW, GetHandleInformation, GetLastError, GetLogicalDriveStringsW, GetModuleHandleA, GetModuleHandleExW, GetProcAddress, GetStartupInfoA, GetStdHandle, GetSystemInfo, GetThreadContext, GetTimeZoneInformation, InitializeCriticalSection, LeaveCriticalSection, LoadLibraryA, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenThread, Process32FirstW, Process32NextW, QueryPerformanceCounter, QueryPerformanceFrequency, ReleaseSemaphore, ResumeThread, RtlCaptureContext, SetEnvironmentVariableW, SetEvent, SetFileAttributesW, SetHandleInformation, SetLastError, Sleep, SuspendThread, SwitchToThread, SystemTimeToTzSpecificLocalTime, TerminateThread, TryEnterCriticalSection, TzSpecificLocalTimeToSystemTime, VerSetConditionMask, VerifyVersionInfoW, VirtualAlloc, VirtualFree, WaitForSingleObject, WideCharToMultiByte, WriteFile, lstrlenW
ADVAPI32.dll	CryptAcquireContextA, CryptAcquireContextW, CryptGenRandom, GetCurrentHwProfileA, RegCloseKey, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegFlushKey, RegOpenKeyExW, RegOpenKeyW, RegQueryInfoKeyW, RegQueryValueExW, RegSetValueExW

Version Infos

Description	Data
LegalCopyright	PileNGril
FileVersion	3.5.5.45852
CompanyName	BitTorrent, Inc.
Comments	This installation was built with Inno Setup.
ProductName	uTorrent
ProductVersion	3.5.5
FileDescription	uTorrent Ad-Free
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 30, 2021 12:48:53.727044106 CET	80	49681	93.184.220.29	192.168.2.3
Jan 30, 2021 12:48:53.727277994 CET	49681	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:48:54.137741089 CET	49682	80	192.168.2.3	2.20.142.210
Jan 30, 2021 12:48:54.137790918 CET	49684	80	192.168.2.3	2.20.142.210
Jan 30, 2021 12:48:54.178510904 CET	80	49682	2.20.142.210	192.168.2.3
Jan 30, 2021 12:48:54.178554058 CET	80	49684	2.20.142.210	192.168.2.3
Jan 30, 2021 12:48:54.178601027 CET	49682	80	192.168.2.3	2.20.142.210
Jan 30, 2021 12:48:54.178685904 CET	49684	80	192.168.2.3	2.20.142.210
Jan 30, 2021 12:48:54.632664919 CET	49688	80	192.168.2.3	84.53.167.113
Jan 30, 2021 12:48:54.632900000 CET	49687	443	192.168.2.3	2.17.179.193
Jan 30, 2021 12:48:54.672991037 CET	80	49688	84.53.167.113	192.168.2.3
Jan 30, 2021 12:48:54.673034906 CET	443	49687	2.17.179.193	192.168.2.3
Jan 30, 2021 12:48:54.673062086 CET	443	49687	2.17.179.193	192.168.2.3
Jan 30, 2021 12:48:54.673077106 CET	49688	80	192.168.2.3	84.53.167.113
Jan 30, 2021 12:48:54.673158884 CET	49687	443	192.168.2.3	2.17.179.193
Jan 30, 2021 12:48:54.673244953 CET	49687	443	192.168.2.3	2.17.179.193
Jan 30, 2021 12:48:54.995763063 CET	80	49680	93.184.220.29	192.168.2.3
Jan 30, 2021 12:48:54.995980978 CET	49680	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:48:55.649527073 CET	80	49692	93.184.220.29	192.168.2.3
Jan 30, 2021 12:48:55.649686098 CET	49692	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:48:56.030251026 CET	49694	443	192.168.2.3	23.210.249.50
Jan 30, 2021 12:48:56.030441046 CET	49695	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:48:56.420047998 CET	80	49690	93.184.220.29	192.168.2.3
Jan 30, 2021 12:48:56.420243979 CET	49690	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:48:58.856261015 CET	49705	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:48:58.856379986 CET	49706	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.301506996 CET	49686	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.301831961 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.355307102 CET	443	49686	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.355344057 CET	443	49686	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.355382919 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.355408907 CET	49686	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.355475903 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.356247902 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.392833948 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.395104885 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.395150900 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.395170927 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.395205975 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.395207882 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.395252943 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.395260096 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.395291090 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.395306110 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.395328999 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.395344019 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.395380974 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.416218996 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.450968981 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.452146053 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.452181101 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.452303886 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.452353954 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.464410067 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.464461088 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.464564085 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.464699984 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.498876095 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.498914957 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.498939991 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.498965025 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.499043941 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.499082088 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.499090910 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.499119997 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.499160051 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.499181032 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.499480009 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.499573946 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.499803066 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.499876022 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.533567905 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.533759117 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.533875942 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.533905983 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.533992052 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.534034014 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.534219027 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.534246922 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.534341097 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.534379005 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.534502983 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.534535885 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.534590006 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.542581081 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.570561886 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.570774078 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.571026087 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.571101904 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.571168900 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.571610928 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.571978092 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.572069883 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.572140932 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:29.572442055 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.572648048 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.578960896 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.578996897 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.579384089 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.605263948 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.605554104 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.605834007 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.605860949 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.669469118 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:29.669548988 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:34.996772051 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:35.035645962 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:35.035734892 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:35.035780907 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:35.035839081 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:35.035877943 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:35.035902977 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:35.035934925 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:35.035958052 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:35.048726082 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:35.262881041 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:35.565162897 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:36.170741081 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:36.208750963 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.210202932 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:36.244839907 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.245158911 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.251609087 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:36.286386967 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.286588907 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.291987896 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:36.326559067 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.326750040 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.332303047 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:36.366930008 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.367244005 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.372664928 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:36.407388926 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.407432079 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.407457113 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.413134098 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:36.447772980 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.448081017 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.448117971 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.453756094 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:36.488445044 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.488713980 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.494194031 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:36.531416893 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.531455994 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.531514883 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.531646967 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.531711102 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.534682989 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:36.572005987 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.572885036 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.572927952 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.575038910 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:36.611936092 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.612267971 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.612996101 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.613035917 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.613329887 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.615464926 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:36.652781010 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.652972937 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.653794050 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.653831959 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.716428995 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:36.736608028 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:42.183387041 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:42.183595896 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:42.218197107 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.218240023 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.218368053 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.218393087 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.218525887 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:42.218635082 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.218683958 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:42.218713045 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:42.253251076 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.253360987 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:42.253992081 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.254030943 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.254060984 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.254086971 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.254112005 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.254153013 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:42.254162073 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.254187107 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.254538059 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.254569054 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.254772902 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.254941940 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.255038977 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:42.255058050 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.255125046 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.255374908 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.255539894 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.255601883 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:42.287971973 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.379841089 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:49:42.380002022 CET	49728	443	192.168.2.3	204.79.197.200
Jan 30, 2021 12:49:43.168160915 CET	49696	443	192.168.2.3	40.126.31.1
Jan 30, 2021 12:49:43.168277979 CET	49681	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:49:43.168317080 CET	49680	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:49:43.168330908 CET	49692	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:49:43.212086916 CET	80	49681	93.184.220.29	192.168.2.3
Jan 30, 2021 12:49:43.212129116 CET	80	49680	93.184.220.29	192.168.2.3
Jan 30, 2021 12:49:43.212156057 CET	80	49692	93.184.220.29	192.168.2.3
Jan 30, 2021 12:49:43.212189913 CET	49681	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:49:43.212225914 CET	49680	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:49:43.213871002 CET	49692	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:49:43.229609013 CET	443	49696	40.126.31.1	192.168.2.3
Jan 30, 2021 12:49:43.229698896 CET	49696	443	192.168.2.3	40.126.31.1
Jan 30, 2021 12:49:43.358932018 CET	49689	443	192.168.2.3	40.126.31.1
Jan 30, 2021 12:49:43.418675900 CET	443	49689	40.126.31.1	192.168.2.3
Jan 30, 2021 12:49:43.418817043 CET	49689	443	192.168.2.3	40.126.31.1
Jan 30, 2021 12:49:57.855977058 CET	80	49690	93.184.220.29	192.168.2.3
Jan 30, 2021 12:49:57.856859922 CET	49690	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:50:09.509759903 CET	80	49690	93.184.220.29	192.168.2.3
Jan 30, 2021 12:50:09.509869099 CET	49690	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:50:25.430608034 CET	49730	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:25.558779955 CET	80	49730	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:25.558980942 CET	49730	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:25.559134007 CET	49730	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:25.685137987 CET	80	49730	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:25.686065912 CET	80	49730	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:25.686115026 CET	80	49730	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:25.686317921 CET	49730	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:25.686376095 CET	49730	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:25.812247992 CET	80	49730	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:25.823311090 CET	49731	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:25.952064991 CET	80	49731	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:25.952167988 CET	49731	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:25.952481031 CET	49731	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:26.081188917 CET	80	49731	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:26.083666086 CET	80	49731	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:26.083697081 CET	80	49731	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:26.083767891 CET	49731	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:27.314204931 CET	49731	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:27.441914082 CET	80	49731	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:29.096415997 CET	49690	80	192.168.2.3	93.184.220.29
Jan 30, 2021 12:50:29.141625881 CET	80	49690	93.184.220.29	192.168.2.3
Jan 30, 2021 12:50:40.287142038 CET	49732	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:40.343025923 CET	80	49732	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:40.343132973 CET	49732	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:40.357351065 CET	49732	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:40.411885023 CET	80	49732	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:40.411926985 CET	80	49732	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:40.411963940 CET	80	49732	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:40.412051916 CET	49732	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:40.426367998 CET	49732	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:40.482860088 CET	80	49732	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:40.574064016 CET	49733	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:40.700162888 CET	80	49733	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:40.700323105 CET	49733	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:40.783230066 CET	49733	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:40.910521984 CET	80	49733	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:40.911871910 CET	80	49733	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:40.911900997 CET	80	49733	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:40.912043095 CET	49733	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:40.914201021 CET	49733	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:41.039948940 CET	80	49733	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:42.067137957 CET	49734	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:42.192801952 CET	80	49734	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:42.192905903 CET	49734	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:42.213516951 CET	49734	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:42.215018034 CET	49735	80	192.168.2.3	173.254.195.58
Jan 30, 2021 12:50:42.339247942 CET	80	49734	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:42.340085030 CET	80	49734	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:42.340141058 CET	80	49734	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:42.340210915 CET	49734	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:42.406959057 CET	49734	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:42.533654928 CET	80	49734	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:43.084872007 CET	49736	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:43.210632086 CET	80	49736	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:43.210760117 CET	49736	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:43.215161085 CET	49736	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:43.343334913 CET	80	49736	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:43.344796896 CET	80	49736	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:43.344825029 CET	80	49736	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:43.344897032 CET	49736	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:43.345021963 CET	49736	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:43.417115927 CET	49737	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:43.471204996 CET	80	49736	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:43.545836926 CET	80	49737	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:43.545928955 CET	49737	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:43.549901009 CET	49737	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:43.675903082 CET	80	49737	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:43.677020073 CET	80	49737	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:43.677052021 CET	80	49737	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:43.677122116 CET	49737	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:43.677455902 CET	49737	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:50:43.770483017 CET	49738	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:43.805079937 CET	80	49737	50.17.220.153	192.168.2.3
Jan 30, 2021 12:50:43.896166086 CET	80	49738	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:43.896259069 CET	49738	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:43.899668932 CET	49738	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:44.027112961 CET	80	49738	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:44.028239012 CET	80	49738	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:44.028270006 CET	80	49738	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:44.028343916 CET	49738	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:44.035991907 CET	49738	80	192.168.2.3	107.22.221.32
Jan 30, 2021 12:50:44.161653996 CET	80	49738	107.22.221.32	192.168.2.3
Jan 30, 2021 12:50:44.292577982 CET	49739	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:44.418787003 CET	80	49739	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:44.418889999 CET	49739	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:44.424690962 CET	49739	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:44.551006079 CET	80	49739	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:44.552037001 CET	80	49739	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:44.552081108 CET	80	49739	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:44.552165031 CET	49739	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:44.552285910 CET	49739	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:44.678388119 CET	80	49739	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:45.303848982 CET	49735	80	192.168.2.3	173.254.195.58
Jan 30, 2021 12:50:51.437478065 CET	49735	80	192.168.2.3	173.254.195.58
Jan 30, 2021 12:50:54.633599043 CET	49740	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:54.759625912 CET	80	49740	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:54.759757042 CET	49740	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:54.800342083 CET	49740	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:54.926248074 CET	80	49740	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:54.927063942 CET	80	49740	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:54.927095890 CET	80	49740	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:54.927170992 CET	49740	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:54.934107065 CET	49740	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:55.062338114 CET	80	49740	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:56.021275043 CET	49741	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:56.147237062 CET	80	49741	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:56.148447037 CET	49741	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:56.148607016 CET	49741	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:56.277087927 CET	80	49741	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:56.279367924 CET	80	49741	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:56.279401064 CET	80	49741	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:56.279529095 CET	49741	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:56.286602020 CET	49741	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:56.412458897 CET	80	49741	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:56.644730091 CET	49742	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.645423889 CET	49743	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.697571993 CET	80	49743	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.697670937 CET	49743	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.701069117 CET	80	49742	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.701179028 CET	49742	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.709532022 CET	49742	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.709616899 CET	49743	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.761754036 CET	80	49743	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.761878014 CET	80	49743	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.761919975 CET	80	49743	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.761955976 CET	80	49743	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.761980057 CET	49743	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.761981010 CET	80	49743	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.762033939 CET	49743	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.763467073 CET	49743	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.765482903 CET	80	49742	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.765896082 CET	80	49742	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.765969992 CET	80	49742	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.766011000 CET	80	49742	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.766047955 CET	80	49742	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.766084909 CET	80	49742	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.766110897 CET	49742	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.766124964 CET	80	49742	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.766149044 CET	49742	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.766156912 CET	80	49742	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.766170979 CET	49742	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.766185045 CET	80	49742	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.766243935 CET	49742	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.787811041 CET	49742	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:56.817959070 CET	80	49743	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:56.846297026 CET	80	49742	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:57.116076946 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.173093081 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.173249006 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.247925997 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.305404902 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.305890083 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.305964947 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.332173109 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.332581997 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.378850937 CET	49747	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:57.386622906 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.386730909 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.388186932 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.388974905 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.389081001 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.415364027 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.417093992 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.469523907 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.469976902 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470021009 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470058918 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470060110 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470083952 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470098019 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470127106 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470134974 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470144033 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470185995 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470208883 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470228910 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470249891 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470274925 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470280886 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470319986 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470335007 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470357895 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470374107 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470393896 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470415115 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470432043 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470453978 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470468044 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470488071 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470514059 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470525026 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470556021 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470571995 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470592022 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470612049 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470629930 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470648050 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470666885 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470683098 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470710993 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470726967 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470758915 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470765114 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470796108 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.470818043 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.470849991 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.473103046 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.473439932 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.473483086 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.473520994 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.473535061 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.473575115 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.473603010 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.473611116 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.473613977 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.473620892 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.473658085 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.473673105 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.473700047 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.473712921 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.473756075 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.473783970 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.473840952 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.473855972 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.473896980 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474011898 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474061966 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474077940 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474103928 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474117041 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474152088 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474169016 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474195004 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474214077 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474231958 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474267960 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474282980 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474298954 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474306107 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474318027 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474343061 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474358082 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474390030 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474395990 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474431038 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474447012 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474467039 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474503040 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474508047 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474528074 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474545002 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474558115 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474580050 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474606037 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474625111 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474654913 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474663019 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474693060 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474709988 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474724054 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474750996 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474764109 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474787951 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474807978 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474826097 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474842072 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474863052 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474901915 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474917889 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.474930048 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.474971056 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.504653931 CET	80	49747	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:57.504770994 CET	49747	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:57.509234905 CET	49747	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:57.532393932 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532440901 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532476902 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532506943 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532515049 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532536030 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532541037 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532552958 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532567024 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532601118 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532609940 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532643080 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532659054 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532679081 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532699108 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532717943 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532732964 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532756090 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532780886 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532793999 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532830954 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532831907 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532851934 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532870054 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532893896 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532917976 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532938957 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532959938 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.532975912 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.532995939 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533014059 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533034086 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533051014 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533071041 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533091068 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533130884 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533185959 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533233881 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533252001 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533274889 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533289909 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533310890 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533339024 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533349037 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533369064 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533416986 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533441067 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533479929 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533499002 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533516884 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533540964 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533567905 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533572912 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533607960 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533624887 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533659935 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533663988 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533700943 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533729076 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533757925 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533793926 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533838987 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533884048 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533902884 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533925056 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533953905 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.533972979 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.533984900 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534020901 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534038067 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534073114 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534096956 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534118891 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534122944 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534171104 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534187078 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534216881 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534230947 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534260988 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534276962 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534302950 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534356117 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534373999 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534383059 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534396887 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534411907 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534451008 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534451008 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534502029 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534533978 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534543991 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534560919 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534595966 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534600019 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534638882 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534646988 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534684896 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534696102 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534728050 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534758091 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:50:57.534768105 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534799099 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.534837961 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:50:57.641062021 CET	80	49747	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:57.641100883 CET	80	49747	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:57.641200066 CET	49747	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:57.642214060 CET	49747	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:57.717781067 CET	49748	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:57.770273924 CET	80	49747	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:57.843883991 CET	80	49748	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:57.843986988 CET	49748	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:57.847450972 CET	49748	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:57.974627018 CET	80	49748	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:57.975632906 CET	80	49748	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:57.975660086 CET	80	49748	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:57.975728035 CET	49748	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:57.975792885 CET	49748	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.044078112 CET	49749	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:58.103936911 CET	80	49748	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.171904087 CET	80	49749	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:58.172024965 CET	49749	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:58.172425032 CET	49749	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:58.243576050 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.243629932 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.298197985 CET	80	49749	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:58.299338102 CET	80	49749	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:58.299371958 CET	80	49749	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:58.299462080 CET	49749	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:58.299540997 CET	49749	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:58.368973970 CET	49752	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.372292042 CET	443	49750	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.372323990 CET	443	49751	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.372395039 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.372514009 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.429096937 CET	80	49749	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:58.483880043 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.483983994 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.494903088 CET	80	49752	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.495057106 CET	49752	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.495243073 CET	49752	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.612590075 CET	443	49750	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.612705946 CET	443	49751	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.615289927 CET	443	49750	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.615331888 CET	443	49751	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.615369081 CET	443	49750	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.615367889 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.615405083 CET	443	49750	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.615438938 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.615442991 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.615453005 CET	443	49751	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.615456104 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.615495920 CET	443	49751	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.615508080 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.615521908 CET	443	49751	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.615545988 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.615550041 CET	443	49750	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.615571976 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.615602970 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.616939068 CET	443	49751	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.617006063 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.617115974 CET	443	49750	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.617183924 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.620999098 CET	80	49752	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.622387886 CET	80	49752	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.622416973 CET	80	49752	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.622550964 CET	49752	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.622603893 CET	49752	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.678638935 CET	49753	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:58.705185890 CET	49754	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:58.733987093 CET	80	49753	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:58.734147072 CET	49753	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:58.734328032 CET	49753	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:58.739696980 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.740439892 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.750473022 CET	80	49752	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.787841082 CET	80	49753	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:58.787894964 CET	80	49753	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:58.787934065 CET	80	49753	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:58.787971973 CET	80	49753	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:58.788008928 CET	80	49753	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:58.788021088 CET	49753	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:58.788048029 CET	80	49753	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:58.788068056 CET	49753	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:58.788086891 CET	80	49753	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:58.788127899 CET	80	49753	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:58.788141966 CET	49753	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:58.788157940 CET	80	49753	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:58.788212061 CET	49753	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:58.789690018 CET	49753	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:58.833265066 CET	80	49754	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:58.833422899 CET	49754	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:58.842248917 CET	49754	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:58.842957020 CET	80	49753	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:58.865725994 CET	443	49750	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.865827084 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.867141008 CET	443	49751	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:58.867290020 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.909924984 CET	49755	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:58.923059940 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.927634954 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:58.966118097 CET	80	49755	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:58.966221094 CET	49755	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:58.970077038 CET	80	49754	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:58.971245050 CET	80	49754	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:58.971271038 CET	80	49754	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:58.971412897 CET	49754	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:58.971465111 CET	49754	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:58.982105970 CET	49755	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.038194895 CET	80	49755	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.038240910 CET	80	49755	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.038289070 CET	80	49755	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.038327932 CET	80	49755	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.038367033 CET	80	49755	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.038404942 CET	80	49755	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.038440943 CET	80	49755	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.038446903 CET	49755	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.038474083 CET	80	49755	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.038486004 CET	49755	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.038491964 CET	49755	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.038500071 CET	80	49755	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.038570881 CET	49755	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.050182104 CET	443	49750	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:59.050261021 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:59.054894924 CET	443	49751	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:59.055061102 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:59.097276926 CET	80	49754	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:59.190220118 CET	49756	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:59.192321062 CET	49755	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.249924898 CET	80	49755	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.317487955 CET	80	49756	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:59.317586899 CET	49756	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:59.431024075 CET	49756	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:59.431210041 CET	49757	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.485878944 CET	80	49757	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.485992908 CET	49757	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.486192942 CET	49757	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.539468050 CET	80	49757	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.539519072 CET	80	49757	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.539566040 CET	80	49757	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.539608002 CET	80	49757	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.539645910 CET	80	49757	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.539664984 CET	49757	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.539686918 CET	80	49757	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.539701939 CET	49757	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.539741993 CET	80	49757	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.539773941 CET	80	49757	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.539799929 CET	80	49757	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.539805889 CET	49757	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.539854050 CET	49757	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.541640997 CET	49757	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.562489033 CET	80	49756	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:59.572419882 CET	80	49756	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:59.572446108 CET	80	49756	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:59.572515965 CET	49756	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:59.591592073 CET	49756	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:50:59.594594955 CET	80	49757	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.659390926 CET	49758	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.711471081 CET	80	49758	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.711661100 CET	49758	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.718936920 CET	80	49756	54.243.113.215	192.168.2.3
Jan 30, 2021 12:50:59.731627941 CET	49758	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.738893986 CET	49759	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:59.783634901 CET	80	49758	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.784324884 CET	80	49758	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.784375906 CET	80	49758	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.784427881 CET	80	49758	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.784476042 CET	80	49758	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.784507990 CET	49758	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.784534931 CET	80	49758	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.784552097 CET	49758	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.784585953 CET	80	49758	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.784625053 CET	80	49758	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.784646988 CET	49758	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.784657955 CET	80	49758	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.784712076 CET	49758	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.863900900 CET	49758	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:50:59.865011930 CET	80	49759	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:59.865155935 CET	49759	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:59.866168976 CET	49759	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:50:59.916155100 CET	80	49758	178.79.242.147	192.168.2.3
Jan 30, 2021 12:50:59.992244005 CET	80	49759	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:59.993320942 CET	80	49759	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:59.993347883 CET	80	49759	54.197.251.114	192.168.2.3
Jan 30, 2021 12:50:59.993448019 CET	49759	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:00.074559927 CET	49760	80	192.168.2.3	98.143.146.7
Jan 30, 2021 12:51:00.074620962 CET	49761	80	192.168.2.3	98.143.146.7
Jan 30, 2021 12:51:00.167529106 CET	49759	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:00.190063000 CET	49762	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.244493008 CET	80	49762	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.244729996 CET	49762	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.251905918 CET	80	49761	98.143.146.7	192.168.2.3
Jan 30, 2021 12:51:00.251944065 CET	80	49760	98.143.146.7	192.168.2.3
Jan 30, 2021 12:51:00.252059937 CET	49760	80	192.168.2.3	98.143.146.7
Jan 30, 2021 12:51:00.252084970 CET	49761	80	192.168.2.3	98.143.146.7
Jan 30, 2021 12:51:00.252202034 CET	49760	80	192.168.2.3	98.143.146.7
Jan 30, 2021 12:51:00.293906927 CET	49763	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:00.294020891 CET	49762	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.294142008 CET	80	49759	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:00.349050045 CET	80	49762	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.349107981 CET	80	49762	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.349198103 CET	80	49762	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.349261045 CET	80	49762	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.349265099 CET	49762	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.349315882 CET	80	49762	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.349366903 CET	80	49762	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.349368095 CET	49762	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.349481106 CET	80	49762	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.349529028 CET	80	49762	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.349539042 CET	49762	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.349601030 CET	80	49762	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.349658966 CET	49762	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.352086067 CET	49762	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.406552076 CET	80	49762	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.419847965 CET	80	49763	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:00.419939995 CET	49763	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:00.428190947 CET	49763	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:00.430963993 CET	80	49760	98.143.146.7	192.168.2.3
Jan 30, 2021 12:51:00.432115078 CET	80	49760	98.143.146.7	192.168.2.3
Jan 30, 2021 12:51:00.432214022 CET	49760	80	192.168.2.3	98.143.146.7
Jan 30, 2021 12:51:00.476459980 CET	49764	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.530582905 CET	80	49764	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.530729055 CET	49764	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.530931950 CET	49764	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.559006929 CET	80	49763	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:00.567274094 CET	80	49763	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:00.567320108 CET	80	49763	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:00.567410946 CET	49763	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:00.567490101 CET	49763	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:00.570050955 CET	49766	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.570055962 CET	49765	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.584481001 CET	80	49764	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.584537983 CET	80	49764	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.584616899 CET	80	49764	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.584667921 CET	80	49764	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.584688902 CET	49764	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.584716082 CET	80	49764	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.584767103 CET	49764	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.584772110 CET	80	49764	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.584821939 CET	80	49764	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.584861994 CET	80	49764	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.584870100 CET	49764	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.584923983 CET	80	49764	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.584975004 CET	49764	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.609568119 CET	49764	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.622179985 CET	80	49765	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:00.622332096 CET	49765	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.622478008 CET	49765	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.622840881 CET	80	49766	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:00.622956991 CET	49766	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.664915085 CET	80	49764	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.676944017 CET	80	49765	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:00.676990032 CET	80	49765	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:00.677061081 CET	49765	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.693722010 CET	80	49763	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:00.718820095 CET	49767	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.719978094 CET	49768	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:00.775362015 CET	80	49767	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.775465012 CET	49767	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.776796103 CET	49767	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.784637928 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.831120014 CET	80	49767	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.831510067 CET	80	49767	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.831549883 CET	80	49767	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.831595898 CET	80	49767	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.831602097 CET	49767	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.831638098 CET	80	49767	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.831675053 CET	80	49767	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.831690073 CET	49767	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.831712008 CET	80	49767	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.831743002 CET	80	49767	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.831765890 CET	80	49767	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.831769943 CET	49767	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.831816912 CET	49767	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.833383083 CET	49767	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.837577105 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:00.837678909 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.840475082 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.847187996 CET	80	49768	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:00.847295046 CET	49768	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:00.847676039 CET	49768	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:00.887465954 CET	80	49767	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:00.890644073 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:00.893470049 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:00.894958973 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:00.895014048 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:00.895052910 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:00.895060062 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.895087957 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:00.895090103 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.895098925 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.895121098 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:00.895149946 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.895184994 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.952424049 CET	49770	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:00.964437008 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.966053963 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.966196060 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:00.973475933 CET	80	49768	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:00.974508047 CET	80	49768	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:00.974550962 CET	80	49768	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:00.974618912 CET	49768	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:00.978112936 CET	49768	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:01.005899906 CET	80	49770	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:01.006014109 CET	49770	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:01.017513990 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.017795086 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.017822027 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.017884970 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.017923117 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.019002914 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.019030094 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.019200087 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.019264936 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.019855022 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.019898891 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.019921064 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.019937038 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.019959927 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.019984961 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.019994020 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020026922 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020040035 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020064116 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020081997 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020102978 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020117998 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020140886 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020155907 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020176888 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020196915 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020214081 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020231962 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020252943 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020292997 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020299911 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020301104 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020332098 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020355940 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020369053 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020384073 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020406961 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020421028 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020447016 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020461082 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020489931 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020503044 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020526886 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020546913 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020564079 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020577908 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020610094 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020617008 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020651102 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020663023 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020688057 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020704985 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020725012 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020740986 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020761967 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020776033 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020797014 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020812988 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020824909 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020847082 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020862103 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020874023 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020908117 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020915031 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020948887 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020962954 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.020987988 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.020999908 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.021024942 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.021039963 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.021061897 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.021075964 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.021095991 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.021115065 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.021121025 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.021148920 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.021167994 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.029166937 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.055304050 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.056044102 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.056473017 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.056938887 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.083096981 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.102628946 CET	49770	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:01.104168892 CET	80	49768	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:01.108422041 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.108875036 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109085083 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109128952 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109167099 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109169006 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109190941 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109205008 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109217882 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109241962 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109261990 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109278917 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109299898 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109325886 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109332085 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109366894 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109386921 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109424114 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109431982 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109468937 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109491110 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109508038 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109527111 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109544992 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109561920 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109572887 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109603882 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109616995 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109637976 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109639883 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109663010 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109678030 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109703064 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109714985 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109734058 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109751940 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109767914 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109790087 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109810114 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109827995 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109847069 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109874964 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109889984 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109915018 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109930038 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109952927 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.109970093 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.109991074 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110004902 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110028982 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110047102 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110053062 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110090017 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110110044 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110126019 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110142946 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110174894 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110193014 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110219002 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110244989 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110255957 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110280037 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110296011 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110311031 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110333920 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110348940 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110371113 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110388041 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110410929 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110428095 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110446930 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110464096 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110495090 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110500097 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110536098 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110551119 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110563993 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110591888 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110600948 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110614061 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110637903 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110655069 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110671997 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110688925 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110707998 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110726118 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110745907 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110768080 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110791922 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110800028 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110832930 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110846996 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110868931 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110883951 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110905886 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110922098 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110944033 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.110963106 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.110980034 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111000061 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111017942 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111036062 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111047029 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111072063 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111082077 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111105919 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111123085 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111140013 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111160994 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111181021 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111198902 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111212969 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111237049 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111252069 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111273050 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111289024 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111311913 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111325979 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111347914 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111367941 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111393929 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111403942 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111435890 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111452103 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111473083 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111491919 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111512899 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111526966 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111550093 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111567020 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111577034 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111610889 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111614943 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111633062 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111651897 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111676931 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111699104 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111712933 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111736059 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111761093 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.111763000 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.111793041 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.121912003 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.157881021 CET	80	49770	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:01.158286095 CET	80	49770	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:01.158330917 CET	80	49770	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:01.158366919 CET	80	49770	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:01.158411026 CET	49770	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:01.158415079 CET	80	49770	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:01.158472061 CET	80	49770	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:01.158483028 CET	49770	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:01.158516884 CET	80	49770	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:01.158551931 CET	80	49770	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:01.158572912 CET	49770	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:01.158577919 CET	80	49770	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:01.158632040 CET	49770	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:01.166805029 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.166847944 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.166879892 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.166886091 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.166904926 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.166933060 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.166940928 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.166975975 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.166990042 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167012930 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167037010 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167052031 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167071104 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167088985 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167115927 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167125940 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167151928 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167162895 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167185068 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167200089 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167216063 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167246103 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167254925 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167288065 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167303085 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167324066 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167340994 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167361021 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167375088 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167398930 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167418003 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167438030 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167467117 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167476892 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167494059 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167519093 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167531967 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167565107 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167572021 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167603970 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.167618990 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.167661905 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.169903994 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.176301003 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.177478075 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.177522898 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.177553892 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.177558899 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.177580118 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.177607059 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.177615881 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.177647114 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.177664995 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.177684069 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.177706003 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.177721977 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.177740097 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.177759886 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.177776098 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.177794933 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.177814007 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.177829981 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.177845955 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.177855968 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.177886963 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.177901983 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.183044910 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.183619022 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.183976889 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.184232950 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.184457064 CET	49774	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.184514046 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.201350927 CET	49770	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:01.218965054 CET	49775	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:01.224457979 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225058079 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225107908 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225131989 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.225148916 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225168943 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.225184917 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225205898 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.225223064 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225250006 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.225259066 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225284100 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.225295067 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225316048 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.225332975 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225347996 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.225369930 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225419044 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.225426912 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.225454092 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225503922 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225513935 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.225537062 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225560904 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.225560904 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.225594044 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.225620031 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.229995966 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.230074883 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.230269909 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.232913971 CET	443	49774	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.233027935 CET	49774	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.233165026 CET	49774	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.237611055 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.238382101 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.238445997 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.238496065 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.238512039 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.238534927 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.238544941 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.238549948 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.238562107 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.238600016 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.238617897 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.238713026 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.238742113 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.239001036 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.239048958 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.239078999 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.239116907 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.239090919 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.239159107 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.239191055 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.239193916 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.239222050 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.239237070 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.239253044 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.239265919 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.239291906 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.239295006 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.239347935 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.240045071 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.240093946 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.240123987 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.240134954 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.240148067 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.240170956 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.240186930 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.240199089 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.240223885 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.240226984 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.240246058 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.240269899 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.256264925 CET	80	49770	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:01.274322033 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.274892092 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.274930954 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.274966955 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.275027037 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.275070906 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.275078058 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.277201891 CET	443	49774	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.277539968 CET	443	49774	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.277580976 CET	443	49774	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.277616978 CET	443	49774	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.277653933 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.277652025 CET	49774	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.277713060 CET	49774	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.277736902 CET	49774	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.277748108 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.279335022 CET	443	49774	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.279489994 CET	49774	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.280145884 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.284101009 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.284209013 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.284296989 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.306662083 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.306906939 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.306972980 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.312390089 CET	49774	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.312508106 CET	49774	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.332901001 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.333795071 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.333832026 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.333856106 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.333878994 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.333904028 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.333915949 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.337481976 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.337511063 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.337536097 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.337955952 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.337992907 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338048935 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338058949 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338073969 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338099957 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338120937 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338124990 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338151932 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338155985 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338176012 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338188887 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338211060 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338238001 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338273048 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338275909 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338300943 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338311911 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338325977 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338349104 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338362932 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338386059 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338402987 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338423014 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338437080 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338479042 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338481903 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338521004 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338545084 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338546991 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338581085 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338589907 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338593960 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338632107 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338648081 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338666916 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338686943 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338705063 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338725090 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338742018 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338766098 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338778973 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338799000 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338816881 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338841915 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338851929 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338879108 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338897943 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338912010 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338937998 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338953018 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.338973999 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.338990927 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339010954 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339030027 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339039087 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339066029 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339073896 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339093924 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339111090 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339128971 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339147091 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339163065 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339193106 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339200974 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339234114 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339252949 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339270115 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339292049 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339307070 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339323997 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339343071 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339365959 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339379072 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339401960 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339416981 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339430094 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339451075 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339473009 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339484930 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.339507103 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.339541912 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.344767094 CET	80	49775	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:01.344882011 CET	49775	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:01.349426031 CET	49780	443	192.168.2.3	52.217.98.3
Jan 30, 2021 12:51:01.350824118 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.350934029 CET	49781	443	192.168.2.3	52.217.98.3
Jan 30, 2021 12:51:01.351211071 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.351234913 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.353024960 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.353097916 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.353415966 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.353487015 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.353677034 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.356632948 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.356664896 CET	443	49774	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.356688976 CET	443	49774	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.356708050 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.356713057 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.356769085 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.357036114 CET	443	49774	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.357064962 CET	443	49774	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.357139111 CET	49774	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.357184887 CET	49774	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.357553959 CET	49774	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.380038023 CET	49782	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.380260944 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.399442911 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.401773930 CET	443	49774	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.425050974 CET	443	49782	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.425153017 CET	49782	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.425406933 CET	49782	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.425755024 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.425837994 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.426261902 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.455451012 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.471340895 CET	443	49782	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.472671032 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.474394083 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.474436045 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.474478960 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.474525928 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.474771976 CET	443	49782	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.474808931 CET	443	49782	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.474845886 CET	49782	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.474890947 CET	49782	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.477440119 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.477530003 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.477861881 CET	443	49782	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.477948904 CET	49782	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.481810093 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.481962919 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.482028961 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.484663963 CET	49782	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.484880924 CET	49782	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.490768909 CET	80	49746	178.79.242.181	192.168.2.3
Jan 30, 2021 12:51:01.490869045 CET	49746	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:51:01.497874975 CET	49775	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:01.501560926 CET	80	49745	178.79.242.181	192.168.2.3
Jan 30, 2021 12:51:01.501585960 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.501636028 CET	49745	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:51:01.504112959 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.504153013 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.504211903 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.504241943 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.504693985 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.504731894 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.504767895 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.504784107 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.505976915 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.506016016 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.506063938 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.506087065 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.507217884 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.507266045 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.507314920 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.507339001 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.508497000 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.508572102 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.508584023 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.508632898 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.509733915 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.509818077 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.509855986 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.509917021 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.510968924 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.511008024 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.511045933 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.511061907 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.512151003 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.512188911 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.512223005 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.512242079 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.513468981 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.513511896 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.513544083 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.513566971 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.514611959 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.514676094 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.514703035 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.514727116 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.515927076 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.515966892 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.516010046 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.516035080 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.517085075 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.517127037 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.517167091 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.517190933 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.518383980 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.518420935 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.518457890 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.518472910 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.519542933 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.519582033 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.519632101 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.519656897 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.520823002 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.520862103 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.520901918 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.520926952 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.522042036 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.522079945 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.522113085 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.522144079 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.523823023 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.523896933 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.525721073 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.525794983 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.526155949 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.526215076 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.526231050 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.526269913 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.526289940 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.526324034 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.526381016 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.528521061 CET	443	49782	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.528618097 CET	49782	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.528877974 CET	443	49782	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.528951883 CET	49782	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.529277086 CET	49782	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.529746056 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.529776096 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.529814005 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.529838085 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.530093908 CET	443	49782	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.530158997 CET	49782	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.532526016 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.532555103 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.532593966 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.532613993 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.535743952 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.535810947 CET	49783	443	192.168.2.3	91.228.74.189
Jan 30, 2021 12:51:01.548899889 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.548960924 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.549161911 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.549201965 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.549221992 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.549252033 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.550685883 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.550724030 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.550765038 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.550790071 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.551599979 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.551651001 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.551692963 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.551717043 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.552872896 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.552918911 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.552936077 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.552973032 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.554070950 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.554114103 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.554137945 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.554160118 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.555303097 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.555346966 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.555378914 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.555392027 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.556544065 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.556581974 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.556617022 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.556641102 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.557779074 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.557817936 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.557837009 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.557873011 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.559011936 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.559053898 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.559075117 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.559101105 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.560276985 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.560314894 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.560359001 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.560383081 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.561594963 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.561636925 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.561667919 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.561691046 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.562741995 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.562782049 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.562817097 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.562834978 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.564028978 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.564068079 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.564091921 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.564119101 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.565201044 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.565229893 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:01.565274954 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.565300941 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:01.613420963 CET	443	49783	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.617356062 CET	443	49782	91.228.74.189	192.168.2.3
Jan 30, 2021 12:51:01.625844955 CET	80	49775	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:01.626749039 CET	80	49775	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:01.626789093 CET	80	49775	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:01.626872063 CET	49775	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:01.669575930 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.670878887 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.724894047 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.725380898 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.728225946 CET	49775	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:01.753873110 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.806859970 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.809499025 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.809550047 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.809590101 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.809600115 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.809623957 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.809627056 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.809660912 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.809664011 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.809684038 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.809721947 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.809747934 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.809786081 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.809823036 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.809834957 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.809851885 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.809881926 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.809958935 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.809999943 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.810031891 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.810045958 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.810059071 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.810087919 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.810116053 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.810117960 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.810148954 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.810152054 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.810187101 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.810206890 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.810442924 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.810492039 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.810518026 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.810559034 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.810604095 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.810651064 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.810673952 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.810688972 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.810712099 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.810726881 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.810749054 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.810772896 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.810780048 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.810837984 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.810971022 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.811041117 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.811047077 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.811077118 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.811106920 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.811113119 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.811132908 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.811141014 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.811177015 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.811189890 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.811207056 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.811224937 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.811242104 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.811266899 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.811291933 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.811327934 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.811333895 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.811398029 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.811403036 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.811422110 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.811460018 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.811477900 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.853960991 CET	80	49775	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:01.884186983 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.884722948 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.888354063 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.888382912 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.888406038 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.888410091 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.888437986 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.888462067 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.889992952 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.939580917 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.939977884 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.940017939 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.940041065 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.940043926 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.940068960 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.940080881 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.940104008 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.940130949 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.940145969 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.940409899 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.940435886 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.940474033 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.940496922 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.945039988 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.945837021 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.945877075 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.945914030 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.945929050 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.945947886 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.945950985 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.945969105 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.945987940 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946007013 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946033955 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946048021 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946074963 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946094036 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946110010 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946136951 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946146965 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946171999 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946185112 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946212053 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946219921 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946247101 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946257114 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946284056 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946299076 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946315050 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946330070 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946337938 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946372032 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946386099 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946408033 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946429014 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946444988 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946472883 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946481943 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946511984 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946516991 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946537018 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946556091 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946578026 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946579933 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:01.946620941 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:01.946636915 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.117711067 CET	49790	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:02.172614098 CET	80	49790	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:02.172707081 CET	49790	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:02.189629078 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.190290928 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.207494974 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.207532883 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.207609892 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.207659960 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.242619038 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.242938042 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.242978096 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.243014097 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.243037939 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.243050098 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.243069887 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.243076086 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.243077040 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.243107080 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.243129969 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.243200064 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.244091034 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.244129896 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.244167089 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.244183064 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.244195938 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.244210005 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.244221926 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.244224072 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.244254112 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.244283915 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.293987989 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.349989891 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.350102901 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.390342951 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.396600008 CET	49792	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.396636009 CET	49793	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.397033930 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.406068087 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.417057991 CET	49795	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.417124987 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.426932096 CET	49781	443	192.168.2.3	52.217.98.3
Jan 30, 2021 12:51:02.427659988 CET	49780	443	192.168.2.3	52.217.98.3
Jan 30, 2021 12:51:02.443614960 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.443708897 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.443996906 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.444443941 CET	443	49793	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.444529057 CET	49793	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.444704056 CET	49793	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.446307898 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.447901011 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.447943926 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.447959900 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.447985888 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.448019981 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.448105097 CET	443	49792	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.448178053 CET	49792	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.448405981 CET	49792	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.467622995 CET	443	49795	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.467703104 CET	49795	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.467947006 CET	443	49796	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.467947960 CET	49795	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.468029022 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.469155073 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.490820885 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.491149902 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.491203070 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.491229057 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.491255045 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.491328955 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.491386890 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.492084980 CET	443	49793	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.492268085 CET	443	49793	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.492316008 CET	443	49793	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.492342949 CET	49793	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.492358923 CET	443	49793	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.492394924 CET	49793	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.492408037 CET	49793	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.494314909 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.494384050 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.494525909 CET	443	49793	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.494596004 CET	49793	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.495325089 CET	443	49792	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.495857000 CET	443	49792	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.495949984 CET	443	49792	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.495949984 CET	49792	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.496004105 CET	49792	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.496102095 CET	443	49792	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.496165991 CET	49792	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.497718096 CET	443	49792	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.497795105 CET	49792	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.499394894 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.500890970 CET	49793	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.501693010 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.501821995 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.501876116 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.501921892 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.501956940 CET	49793	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.518785954 CET	443	49795	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.518906116 CET	443	49795	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.518955946 CET	443	49795	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.518981934 CET	49795	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.518987894 CET	443	49795	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.519020081 CET	49795	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.519037008 CET	49795	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.519552946 CET	443	49796	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.519896030 CET	443	49796	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.519937992 CET	443	49796	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.519964933 CET	443	49796	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.519973040 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.519999981 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.520004988 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.520684004 CET	49797	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.522686958 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.531029940 CET	49792	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.531436920 CET	49792	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.532270908 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.532449961 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.532561064 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.532752037 CET	49795	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.532926083 CET	49795	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.546751022 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.547291040 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.547380924 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.547411919 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.547472000 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.547744989 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.548888922 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.548995972 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.549103022 CET	443	49793	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.549335957 CET	443	49793	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.549366951 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.549407959 CET	49793	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.549423933 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.549453974 CET	443	49793	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.549510002 CET	49793	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.549562931 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.549700022 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.549726009 CET	49793	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.550076962 CET	443	49793	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.550164938 CET	443	49793	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.550225973 CET	49793	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.550654888 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.550698042 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.550734043 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.550734997 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.550772905 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.550787926 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.550807953 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.550853968 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.552000046 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.552037954 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.552057028 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.552089930 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.552622080 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.552661896 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.552700996 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.552723885 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.553973913 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.554022074 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.554047108 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.554070950 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.555280924 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.555320978 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.555341005 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.555376053 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.556582928 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.556623936 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.556653976 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.556677103 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.557908058 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.557946920 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.557976007 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.558000088 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.559225082 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.559263945 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.559287071 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.559315920 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.560565948 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.560611963 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.560632944 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.560661077 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.561938047 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.561975002 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.561996937 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.562025070 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.563205957 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.563246965 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.563292027 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.563313007 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.564501047 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.564542055 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.564569950 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.564594984 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.567790985 CET	443	49797	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.567887068 CET	49797	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.568135023 CET	49797	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.569871902 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.569961071 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.570291996 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.577989101 CET	443	49792	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.578211069 CET	443	49792	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.578299046 CET	49792	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.578310013 CET	443	49792	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.578368902 CET	49792	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.578502893 CET	443	49792	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.578560114 CET	443	49792	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.578629971 CET	49792	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.578682899 CET	49792	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.583755016 CET	443	49796	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.583784103 CET	443	49796	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.583831072 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.583856106 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.584096909 CET	443	49796	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.584171057 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.584234953 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.584302902 CET	443	49795	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.584330082 CET	443	49795	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.584372044 CET	49795	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.584399939 CET	49795	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.584444046 CET	443	49795	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.584498882 CET	49795	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.584702969 CET	443	49796	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.584729910 CET	443	49796	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.584772110 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.584796906 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.584939957 CET	443	49796	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.585021973 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.585072994 CET	49795	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.585107088 CET	49796	443	192.168.2.3	108.177.127.155
Jan 30, 2021 12:51:02.591703892 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.591746092 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.591808081 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.592190981 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.592228889 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.592242956 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.592264891 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.592288971 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.593498945 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.593892097 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.593980074 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.593985081 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.594037056 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.594482899 CET	443	49793	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.594903946 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.594940901 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.594971895 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.594997883 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.596138954 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.596199989 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.596232891 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.596290112 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.597481012 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.597522020 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.597563982 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.597589970 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.598850012 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.598886967 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.598929882 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.598958015 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.600135088 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.600204945 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.600238085 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.600300074 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.601434946 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.601473093 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.601528883 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.601550102 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.601779938 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.602783918 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.602824926 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.602854013 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.602951050 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.604166985 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.604207993 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.604226112 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.604274035 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.605427980 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.605468035 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.605490923 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.605519056 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.606702089 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.606743097 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.606782913 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.606802940 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.608037949 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.608078003 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.608100891 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.608128071 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.609343052 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.609399080 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.609407902 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.609455109 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.610740900 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.610800028 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.610810041 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.610858917 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.611995935 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.612036943 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.612056017 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.612061977 CET	443	49797	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.612095118 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.612363100 CET	443	49797	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.612404108 CET	443	49797	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.612427950 CET	49797	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.612440109 CET	443	49797	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.612457037 CET	49797	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.612492085 CET	49797	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.613285065 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.613333941 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.613343954 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.613393068 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.614101887 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.614223957 CET	443	49797	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.614284039 CET	49797	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.614590883 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.614631891 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.614648104 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.614667892 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.614694118 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.614705086 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.614734888 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.614743948 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.614772081 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.614794016 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.615951061 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.615999937 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.616014957 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.616055965 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.617053986 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.617145061 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.617295027 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.617336988 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.617362976 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.617386103 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.618565083 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.618695021 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.618845940 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.619919062 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.619961023 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.620013952 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.620038986 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.621222973 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.621263027 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.621345997 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.621366978 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.621547937 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.621833086 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.621869087 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.622529984 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.622571945 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.622600079 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.622632980 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.622682095 CET	443	49792	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.623868942 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.623904943 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.623930931 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.623965025 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.629122019 CET	49797	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.629327059 CET	49797	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.633217096 CET	443	49796	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.635984898 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.636039019 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.636065960 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.636111021 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.636473894 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.636554956 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.636593103 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.636657953 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.637221098 CET	443	49795	108.177.127.155	192.168.2.3
Jan 30, 2021 12:51:02.637533903 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.637574911 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.637603045 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.637630939 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.638629913 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.638669014 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.638709068 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.638761044 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.639571905 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.639615059 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.639658928 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.639679909 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.640598059 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.640660048 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.640724897 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.640785933 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.641550064 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.641591072 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.641613960 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.641645908 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.642502069 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.642539024 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.642565966 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.642591953 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.643512964 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.643594980 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.643645048 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.643707037 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.644382954 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.644423962 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.644444942 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.644475937 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.645375967 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.645443916 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.645462990 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.645514011 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.646312952 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.646367073 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.646397114 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.646459103 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.647275925 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.647340059 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.647377014 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.647437096 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.648133039 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.648170948 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.648206949 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.648231030 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.649089098 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.649130106 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.649163008 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.649184942 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.650049925 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.650089025 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.650132895 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.650154114 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.651010036 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.651051998 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.651078939 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.651101112 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.651910067 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.651952028 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.651988983 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.652010918 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.652836084 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.652873039 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.652910948 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.652936935 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.653796911 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.653835058 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.653871059 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.653892040 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.654757023 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.654813051 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.654828072 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.654882908 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.655692101 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.655736923 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.655786991 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.655812025 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.656583071 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.656651974 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.656724930 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.656786919 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.657537937 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.657574892 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.657610893 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.657610893 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.657629967 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.657845974 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.657882929 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.657908916 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.657932043 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.658464909 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.658502102 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.658538103 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.658562899 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.659420967 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.659461975 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.659492016 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.659513950 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.660352945 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.660389900 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.660437107 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.660458088 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.661283016 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.661350965 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.661422014 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.661483049 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.662231922 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.662267923 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.662306070 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.662328005 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.663116932 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.663155079 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.663191080 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.663219929 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.664053917 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.664092064 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.664153099 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.664925098 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.664973974 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.664988995 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.665026903 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.665452957 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.665695906 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.665724039 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.665750027 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.665813923 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.665822983 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.665855885 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.665872097 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.665879965 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.665915966 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.665935993 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.666166067 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.666204929 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.666229963 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.666260958 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.666323900 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.666378021 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.666589975 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.666629076 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.666656017 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.666697979 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.666769981 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.666826963 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.667429924 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.667468071 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.667484999 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.667500973 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.667505980 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.667537928 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.667542934 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.667557001 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.667604923 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.668328047 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.668369055 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.668402910 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.668426037 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.668627024 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.668709040 CET	49798	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.669106960 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.669143915 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.669181108 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.669200897 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.670002937 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.670044899 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.670079947 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.670103073 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.670703888 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.670788050 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.670794010 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.670855045 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.671504021 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.671569109 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.671598911 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.671658039 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.672445059 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.672483921 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.672512054 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.672561884 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.672992945 CET	443	49797	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.673199892 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.673240900 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.673269987 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.673310041 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.673322916 CET	443	49797	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.673351049 CET	443	49797	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.673413038 CET	49797	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.673527002 CET	443	49797	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.673580885 CET	49797	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.673799038 CET	49797	443	192.168.2.3	13.226.169.14
Jan 30, 2021 12:51:02.673960924 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.674001932 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.674031973 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.674052954 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.674768925 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.674809933 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.674846888 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.674866915 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.675540924 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.675576925 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.675621986 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.675651073 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.676357031 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.676395893 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.676434994 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.676472902 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.677172899 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.677213907 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.677242041 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.677515030 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.677930117 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.677967072 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.678006887 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.678040028 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.678769112 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.678807020 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.678843021 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.678868055 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.679527044 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.679563999 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.679589987 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.679608107 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.680445910 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.680507898 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.680526972 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.680566072 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.681179047 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.681216955 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.681242943 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.681273937 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.681963921 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.682005882 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.682027102 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.682040930 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.682064056 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.682104111 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.682878017 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.682919025 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.682950974 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.682955980 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.682967901 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.683012962 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.683686972 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.683727980 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.683764935 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.683769941 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.683806896 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.683819056 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.684573889 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.684653997 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.684678078 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.684719086 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.684739113 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.684767962 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.685435057 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.685472965 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.685512066 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.685518980 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.685528040 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.685580015 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.686269045 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.686306953 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.686342001 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.686343908 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.686374903 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.686389923 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.687171936 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.687213898 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.687252045 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.687252045 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.687294006 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.687313080 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.688070059 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.688147068 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.688225985 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.688265085 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.688283920 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.688302040 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.688308954 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.688360929 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.689130068 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.689169884 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.689210892 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.689212084 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.689235926 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.689265966 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.690030098 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.690069914 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.690089941 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.690105915 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.690138102 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.690171003 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.690860033 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.690907955 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.690937042 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.690948009 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.690970898 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.691013098 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.691601038 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.691639900 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.691679955 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.691687107 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.691701889 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.691747904 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.692388058 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.692428112 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.692456961 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.692464113 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.692480087 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.692519903 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.693272114 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.693309069 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.693345070 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.693345070 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.693358898 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.693408966 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.694031954 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.694071054 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.694106102 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.694106102 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.694139957 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.694161892 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.694763899 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.694802999 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.694838047 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.694839954 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.694856882 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.694894075 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.695539951 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.695607901 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.695641041 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.695683956 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.695699930 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.695744991 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.696368933 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.696407080 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.696443081 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.696444035 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.696465969 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.696506023 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.697177887 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.697218895 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.697257042 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.697271109 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.697298050 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.697356939 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.697948933 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.698024035 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.698044062 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.698084116 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.698101044 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.698159933 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.698733091 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.698771954 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.698792934 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.698811054 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.698823929 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.698870897 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.699407101 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.699445963 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.699486971 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.699506044 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.699526072 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.699584961 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.700177908 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.700217009 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.700241089 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.700273037 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.700316906 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.700371027 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.700927973 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.700965881 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.701001883 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.701013088 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.701044083 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.701064110 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.701673985 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.701714993 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.701750994 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.701757908 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.701802015 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.701817036 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.702400923 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.702449083 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.702465057 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.702490091 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.702503920 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.702548981 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.703210115 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.703244925 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.703269958 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.703283072 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.703303099 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.703320026 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.703341007 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.703372002 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.704144001 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.704180956 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.704219103 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.704226971 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.704229116 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.704268932 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.704289913 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.704320908 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.705100060 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.705137014 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.705172062 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.705183029 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.705199957 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.705224991 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.705244064 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.705280066 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.706095934 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.706146955 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.706175089 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.706183910 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.706217051 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.706237078 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.706355095 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.706414938 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.707026958 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.707067013 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.707089901 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.707107067 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.707123041 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.707144976 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.707160950 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.707195997 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.707890987 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.707928896 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.707962990 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.707966089 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.707978964 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.708018064 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.708103895 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.708163977 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.708888054 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.708920002 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.708947897 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.708959103 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.708962917 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.708993912 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.709012032 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.709048033 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.709763050 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.709801912 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.709819078 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.709837914 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.709855080 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.709876060 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.709892035 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.709933043 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.710954905 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.710994959 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.711031914 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.711034060 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.711059093 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.711069107 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.711082935 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.711124897 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.711337090 CET	443	49798	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.711594105 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.711627007 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.711648941 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.711658955 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.711683035 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.711723089 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.712260962 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.712295055 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.712326050 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.712347984 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.712357044 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.712368011 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.712389946 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.712405920 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.714000940 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.714041948 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.714076996 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.714077950 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.714107037 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.714112997 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.714133024 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.714159012 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.714171886 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.714194059 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.714214087 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.714225054 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.714247942 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.714257002 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.714282036 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.714312077 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.715122938 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.715190887 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.715208054 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.715250969 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.715251923 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.715312004 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.715312958 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.715373993 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.715892076 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.715950012 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.715980053 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.716032982 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.716039896 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.716094017 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.716099977 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.716152906 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.716844082 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.716896057 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.716917038 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.716944933 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.716945887 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.716993093 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.716996908 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.717047930 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.717489958 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.717540979 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.717551947 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.717588902 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.717597008 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.717639923 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.717647076 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.717694044 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.717705965 CET	443	49797	13.226.169.14	192.168.2.3
Jan 30, 2021 12:51:02.718302011 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.718353987 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.718367100 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.718404055 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.718410969 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.718452930 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.718460083 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.718508005 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.719132900 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.719187021 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.719202042 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.719235897 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.719254017 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.719285965 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.719289064 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.719345093 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.719980955 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.720036030 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.720055103 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.720084906 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.720098972 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.720134974 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.720135927 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.720185995 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.720772982 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.720825911 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.720844030 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.720875025 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.720894098 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.720925093 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.720931053 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.720973969 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.721599102 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.721653938 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.721673965 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.721702099 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.721719027 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.721750975 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.721765995 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.721801043 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.722398996 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.722451925 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.722472906 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.722501993 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.722513914 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.722549915 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.722551107 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.722601891 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.723273039 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.723330021 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.723345041 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.723386049 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.723388910 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.723453045 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.723539114 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.723597050 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.724029064 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.724087954 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.724113941 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.724205971 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.724236965 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.724275112 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.724288940 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.724339008 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.724843025 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.724894047 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.724896908 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.724942923 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.724945068 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.724991083 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.724997044 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.725042105 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.725600004 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.725656033 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.725656986 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.725711107 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.725717068 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.725769997 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.725779057 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.725836992 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.726346016 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.726398945 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.726406097 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.726448059 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.726449013 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.726496935 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.726496935 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.726546049 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.726615906 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.726681948 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.727327108 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.727377892 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.727396011 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.727427959 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.727442980 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.727477074 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.727478981 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.727524996 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.727526903 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.727572918 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.727576971 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.727627993 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.728307962 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.728352070 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.728357077 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.728394985 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.728404999 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.728439093 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.728445053 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.728482962 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.728499889 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.728527069 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.728538036 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.728579044 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.729558945 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.729598045 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.729635954 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.729638100 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.729652882 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.729671955 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.729686975 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.729708910 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.729729891 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.729744911 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.729764938 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.729809046 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.731383085 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.731441021 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.731441975 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.731493950 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.731501102 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.731554031 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.731559992 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.731616974 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.731631041 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.731672049 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.732477903 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.732521057 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.732567072 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.732605934 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.732640982 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.732685089 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.732697964 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.732728958 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.732737064 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.732795954 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.732800961 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.732856989 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.734189034 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.734225988 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.734244108 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.734262943 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.734280109 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.734299898 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.734317064 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.734335899 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.734352112 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.734390020 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.735709906 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.735769033 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.735784054 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.735827923 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.735843897 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.735883951 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.735888958 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.735940933 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.735949993 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.736006975 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.736007929 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.736062050 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.737484932 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.737544060 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.737567902 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.737610102 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.737627983 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.737667084 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.737672091 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.737729073 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.737731934 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.737787008 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.737792015 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.737845898 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.738989115 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.739042997 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.739063025 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.739092112 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.739100933 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.739140034 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.739147902 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.739187956 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.739192963 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.739237070 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.739240885 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.739284992 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.739289045 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.739336014 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.742724895 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.742788076 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.742801905 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.742861032 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.742863894 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.742918968 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.742922068 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.742974997 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.742980957 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.743037939 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.743040085 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.743094921 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.743098021 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.743158102 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.743161917 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.743215084 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.743216991 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.743273020 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.743275881 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.743331909 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.743335009 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.743390083 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.743668079 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.743724108 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.743731022 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.743777990 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.743783951 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.743843079 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.743849039 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.743899107 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.743901968 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.743953943 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.743962049 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.744018078 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.744043112 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.744101048 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.744163036 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.744219065 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.745296001 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.745357990 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.745368004 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.745440960 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.745446920 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.745492935 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.745495081 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.745542049 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.745549917 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.745596886 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.746563911 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.746617079 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.746649981 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.746668100 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.746675968 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.746716976 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.746721983 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.746766090 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.746773005 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.746813059 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.746819019 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.746876955 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.749224901 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.749275923 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.749304056 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.749317884 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.749322891 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.749367952 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.749380112 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.749423981 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.749432087 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.749476910 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.749489069 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.749521971 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.749527931 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.749577999 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.750796080 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.750844002 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.750857115 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.750888109 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.750895977 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.750932932 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.750938892 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.750977039 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.750983953 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.751020908 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.751028061 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.751065969 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.751070976 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.751110077 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.751116037 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.751163960 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.752032042 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.752093077 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.752106905 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.752151012 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.752154112 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.752207994 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.752213955 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.752265930 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.752274990 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.752334118 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.752345085 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.752399921 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.752399921 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.752453089 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.752454042 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.752506971 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.753561020 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.753614902 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.753653049 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.753671885 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.753679991 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.753725052 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.753737926 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.753770113 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.753782988 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.753815889 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.753830910 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.753859997 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.753866911 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.753916025 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.755400896 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.755449057 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.755476952 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.755494118 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.755507946 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.755538940 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.755552053 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.755584002 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.755597115 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.755642891 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.756292105 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.756345034 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.756367922 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.756378889 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.756405115 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.756436110 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.758457899 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.758522034 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.758554935 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.758627892 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.758641958 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.758713007 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.758774996 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.758827925 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.758836031 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.758884907 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.758894920 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.758930922 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.758940935 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.758976936 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.758996964 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.759021044 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.759032965 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.759073019 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.759481907 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.759530067 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.759542942 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.759574890 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.759582996 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.759619951 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.759627104 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.759665012 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.759677887 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.759711027 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.759722948 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.759754896 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.759759903 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.759799957 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.759819031 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.759844065 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.759856939 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.759896040 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.761632919 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.761701107 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.761712074 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.761789083 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.761861086 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.761919975 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.761929035 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.761986017 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.762331009 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.762393951 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.762425900 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.762480974 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.762516022 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.762573957 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.763334990 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.763390064 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.763412952 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.763444901 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.763451099 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.763499975 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.763505936 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.763555050 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.763557911 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.763607979 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.763614893 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.763664961 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.763669968 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.763719082 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.763739109 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.763772964 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.763777018 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.763825893 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.763833046 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.763883114 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.764235973 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.764281988 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.764309883 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.764329910 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.764344931 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.764374971 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.764384031 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.764420033 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.764437914 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.764465094 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.764481068 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.764518976 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.765553951 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.765604019 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.765631914 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.765666008 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.765681982 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.765711069 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.765717983 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.765755892 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.765769005 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.765800953 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.765814066 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.765855074 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.766274929 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.766314030 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.766346931 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.766371012 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.767469883 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.767498016 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.767553091 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.768958092 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.768997908 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.769017935 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.769037008 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.769049883 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.769076109 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.769090891 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.769114017 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.769130945 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.769151926 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.769169092 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.769191027 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.769207001 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.769231081 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.769244909 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.769259930 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.769330978 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.770132065 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.770189047 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.770210028 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.770248890 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.770261049 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.770306110 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.770308018 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.770366907 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.770366907 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.770421982 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.770482063 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.770540953 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.770543098 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.770592928 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.770600080 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.770658970 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.770669937 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.770716906 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.770724058 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.770762920 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.770770073 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.770814896 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.771547079 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.771599054 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.771612883 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.771650076 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.771663904 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.771712065 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.773916006 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.773969889 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.774002075 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.774019957 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.774024010 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.774069071 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.774084091 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.774118900 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.774127960 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.774168968 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.774175882 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.774218082 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.774224997 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.774271011 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.775489092 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.775540113 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.775548935 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.775588036 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.775593042 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.775638103 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.775639057 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.775692940 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.775710106 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.775731087 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.775825024 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.775832891 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.776707888 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.776776075 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.776779890 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.776823044 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.776829958 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.776870012 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.776876926 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.776916027 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.776921034 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.776962042 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.776968956 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.777007103 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.777012110 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.777053118 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.777061939 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.777098894 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.777105093 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.777144909 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.777153969 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.777193069 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.777205944 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.777251005 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.779860020 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.779902935 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.779938936 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.779943943 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.779959917 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.779975891 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.779983044 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.780011892 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.780035019 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.780057907 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.780072927 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.780101061 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.780117035 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.780163050 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.781184912 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.781236887 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.781255960 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.781275988 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.781294107 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.781316042 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.781347036 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.781352043 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.781358957 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.781404972 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.781420946 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.781475067 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.782814026 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.782851934 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.782907963 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.782918930 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.782929897 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.782960892 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.782982111 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.782996893 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.783018112 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.783058882 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.784641027 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.784687996 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.784709930 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.784723997 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.784770966 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.784811974 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.784812927 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.784848928 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.784854889 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.784871101 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.784910917 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.786253929 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.786312103 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.786350012 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.786390066 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.786421061 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.786427021 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.786444902 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.786464930 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.786485910 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.786504030 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.786530018 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.786540031 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.786566973 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.786577940 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.786596060 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.786613941 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.786629915 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.786664009 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.786672115 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.786720037 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.790383101 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.790425062 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.790462971 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.790482044 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.790509939 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.790515900 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.790985107 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791028023 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791048050 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.791064024 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791085958 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.791101933 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791140079 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791141033 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.791156054 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.791187048 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791198969 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.791229963 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791239977 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.791266918 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791280985 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.791305065 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791318893 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.791344881 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791358948 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.791382074 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791395903 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.791436911 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.791671991 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791733027 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.791765928 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791799068 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.791836023 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.791860104 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.793545961 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.793596983 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.793617010 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.793644905 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.793658972 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.793682098 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.793698072 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.793719053 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.793734074 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.793756962 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.793771029 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.793792963 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.793807030 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.793831110 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.793843031 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.793868065 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.793883085 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.793914080 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.793916941 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.793967009 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.796531916 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.796570063 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.796598911 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.796607018 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.796623945 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.796644926 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.796657085 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.796680927 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.796700001 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.796719074 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.796731949 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.796771049 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.797835112 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.797898054 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.797924042 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.797964096 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.797985077 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.798001051 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.798027992 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.798036098 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.798055887 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.798074961 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.798093081 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.798111916 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.798132896 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.798158884 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.798172951 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.798201084 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.798213959 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.798237085 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.798248053 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.798289061 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.799483061 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.799525023 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.799561024 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.799561977 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.799582005 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.799597025 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.799623013 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.799637079 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.799653053 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.799694061 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.800851107 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.800893068 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.800920963 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.800929070 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.800942898 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.800966978 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.800985098 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.801027060 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.801045895 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.801084995 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.801120996 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.801121950 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.801136971 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.801162958 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.801186085 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.801213026 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.802433014 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.802470922 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.802495956 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.802506924 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.802525043 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.802545071 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.802561045 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.802580118 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.802596092 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.802617073 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.802630901 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.802655935 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.802680016 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.802701950 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.802705050 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.802742958 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.802757025 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.802769899 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.802798033 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.802809954 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.805505037 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.805545092 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.805579901 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.805597067 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.805617094 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.805619001 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.805638075 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.805655956 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.805674076 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.805713892 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.807013988 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.807051897 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.807090044 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.807090044 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.807111979 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.807126045 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.807132959 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.807173014 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.807178020 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.807214022 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.807221889 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.807250023 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.807269096 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.807286978 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.807300091 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.807323933 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.807339907 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.807373047 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.808836937 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.808875084 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.808913946 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.808921099 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.808948994 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.808962107 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.808979988 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.809000969 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.809022903 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.809037924 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.809067011 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.809092045 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.809109926 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.809128046 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.809143066 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.809164047 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.809185982 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.809228897 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.810658932 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.810698986 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.810736895 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.810735941 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.810753107 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.810775042 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.810791016 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.810812950 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.810837984 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.810858965 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.810858965 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.810900927 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.810913086 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.810954094 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.811321974 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.811371088 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.811389923 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.811412096 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.811423063 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.811449051 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.811465025 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.811486959 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.811501026 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.811523914 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.811537981 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.811558962 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.811574936 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.811595917 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.811615944 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.811633110 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.811655045 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.811680079 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.811688900 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.811722040 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.811734915 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.811774015 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.812706947 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.812748909 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.812779903 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.812783003 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.812798977 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.812819958 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.812840939 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.812856913 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.812874079 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.812901974 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.812908888 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.812942982 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.812956095 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.812968969 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.812994003 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.813004017 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.815789938 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.815828085 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.815874100 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.815879107 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.815903902 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.815915108 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.815927982 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.815953016 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.815969944 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.816009998 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.817456007 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.817497969 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.817523003 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.817533970 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.817554951 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.817570925 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.817585945 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.817608118 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.817624092 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.817646027 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.817665100 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.817682028 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.817699909 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.817718029 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.817734957 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.817763090 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.817768097 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.817815065 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.818377018 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.818417072 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.818449020 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.818453074 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.818470001 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.818490028 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.818511963 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.818528891 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.818548918 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.818574905 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.818603039 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.818629980 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.818669081 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.818710089 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.818728924 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.818748951 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.818772078 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.818784952 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.818808079 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.818824053 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.818864107 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.818901062 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.821190119 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.821228981 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.821258068 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.821264982 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.821285009 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.821352005 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.823472023 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.823523045 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.823546886 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.823565006 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.823577881 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.823601007 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.823616028 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.823641062 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.823668003 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.823678970 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.823697090 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.823714972 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.823734045 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.823765039 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.824207067 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.824271917 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.824289083 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.824325085 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.824346066 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.824362993 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.824374914 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.824402094 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.824420929 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.824444056 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.824470043 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.824496031 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.824501991 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.824565887 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.824572086 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.824625015 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.824852943 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.824891090 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.824909925 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.824928045 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.824948072 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.824965954 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.824995041 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.825011969 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.825016975 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.825043917 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.825067043 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.825098038 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.826464891 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.826492071 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.826514959 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.826549053 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.826627970 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.826843023 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.826879978 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.826910019 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.826917887 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.826937914 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.826953888 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.826982975 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.826987028 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.827003956 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.827012062 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:02.827042103 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.827059984 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:02.828428030 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.828459024 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.828488111 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.828486919 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.828507900 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.828516006 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.828545094 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.828546047 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.828564882 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.828572989 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.828602076 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.828643084 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.829547882 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.829580069 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.829601049 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.829607010 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.829638958 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.829641104 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.829654932 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.829668045 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.829694986 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.829695940 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.829713106 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.829751015 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.830354929 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.831131935 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.831171036 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.831198931 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.831202984 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.831223011 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.831233025 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.831262112 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.831262112 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.831291914 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.831293106 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.831312895 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.831320047 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.831350088 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.831357956 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.831378937 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.831378937 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.831410885 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.831414938 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.831429958 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.831445932 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.831465006 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.831501007 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.834677935 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.834708929 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.834738970 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.834758043 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.834768057 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.834781885 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.834798098 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.834810019 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.834826946 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.834841967 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.834856033 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.834855080 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.834883928 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.834891081 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.834920883 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.834920883 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.834943056 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.834953070 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.834973097 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.835016966 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.835546017 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.835592031 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.835618019 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.835621119 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.835634947 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.835649967 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.835669994 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.835680008 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.835700035 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.835707903 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.835733891 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.835738897 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.835750103 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.835768938 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.835788012 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.835804939 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.835819006 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.835839033 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.835856915 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.835867882 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.835886002 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.835922003 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.835983992 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.836039066 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.837471962 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.837510109 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.837543964 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.837560892 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.837587118 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.837599039 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.840820074 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.840867996 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.840883017 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.840909958 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.840933084 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.840946913 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.840966940 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.840980053 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.840985060 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.840990067 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841022015 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841042042 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841057062 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841092110 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841094017 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841113091 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841130972 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841146946 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841177940 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841185093 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841217995 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841233015 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841254950 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841274977 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841293097 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841308117 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841330051 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841352940 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841366053 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841384888 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841429949 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841439009 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841476917 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841480970 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841496944 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841511965 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841538906 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841558933 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841564894 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841600895 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841614962 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841639042 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841655970 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841675997 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.841695070 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.841737986 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.842215061 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.842255116 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.842283010 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.842291117 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.842307091 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.842329025 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.842349052 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.842365026 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.842381954 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.842411041 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.842425108 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.842452049 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.842468023 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.842489004 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.842506886 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.842526913 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.842545986 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.842564106 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.842583895 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.842598915 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.842617989 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.842655897 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.843038082 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.843077898 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.843112946 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.843113899 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.843126059 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.843151093 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.843172073 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.843187094 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.843213081 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.843233109 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.843246937 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.843274117 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.843287945 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.843311071 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.843333960 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.843348026 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.843369961 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.843384981 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.843401909 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.843420982 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.843441010 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.843476057 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.843955994 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.843983889 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.844063997 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.844073057 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.844085932 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.844126940 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.844146967 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.844163895 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.844186068 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.844201088 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.844209909 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.844238043 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.844254017 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.844273090 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.844290018 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.844310999 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.844333887 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.844347000 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.844366074 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.844393015 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.844410896 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.844434023 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.844451904 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.844470024 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.844489098 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.844536066 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.846537113 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.846575975 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.846613884 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.846616983 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.846651077 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.846652985 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.846667051 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.846688986 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.846709013 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.846726894 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.846762896 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.846796989 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.846806049 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.846808910 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.846811056 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.846849918 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.846869946 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.846885920 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.846910000 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.846925020 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.846931934 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.846961021 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.846987963 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.846996069 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847012043 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847033024 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847048044 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847069025 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847088099 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847115040 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847120047 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847156048 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847168922 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847193003 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847209930 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847229958 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847245932 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847266912 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847281933 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847301960 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847320080 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847338915 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847353935 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847400904 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847493887 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847532034 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847568035 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847580910 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847604990 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847611904 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847619057 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847645044 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847662926 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847681046 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847706079 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847727060 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847749949 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847768068 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847789049 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847805977 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847824097 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847842932 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847860098 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847879887 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847898960 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847918987 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847958088 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.847978115 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.847996950 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.848042011 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.848043919 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.848048925 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.848093033 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.848329067 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.848393917 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.848453045 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.848500967 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.848509073 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.848530054 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.848546982 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.848558903 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.848575115 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.848587990 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.848612070 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.848628044 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.848635912 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.848661900 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.848679066 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.848690987 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.848720074 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.848721981 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.848747969 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.848751068 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.848772049 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.848793030 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.849330902 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.849361897 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.849392891 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.849402905 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.849409103 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.849438906 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.849466085 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.849478960 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.849497080 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.849498034 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.849560022 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.849589109 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.849639893 CET	49794	443	192.168.2.3	13.226.169.128
Jan 30, 2021 12:51:02.857794046 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:02.867774963 CET	49806	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:02.875281096 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.886241913 CET	443	49794	13.226.169.128	192.168.2.3
Jan 30, 2021 12:51:02.983727932 CET	443	49805	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:02.983851910 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:02.984210014 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:02.995388985 CET	443	49806	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:02.995544910 CET	49806	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:02.995728016 CET	49806	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.004410982 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.004604101 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.060512066 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.060549974 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061008930 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061045885 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061100960 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061129093 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061158895 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061218023 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061229944 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061276913 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061281919 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061332941 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061336994 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061399937 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061419964 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061474085 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061476946 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061522961 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061528921 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061570883 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061575890 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061619043 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061625004 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061677933 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061708927 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061769009 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061777115 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061827898 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061835051 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061880112 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061882019 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061935902 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061939001 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.061992884 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.061997890 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062051058 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062058926 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062108994 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062118053 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062166929 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062176943 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062232018 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062236071 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062289953 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062295914 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062345982 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062355995 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062412024 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062416077 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062474012 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062475920 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062532902 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062535048 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062587976 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062593937 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062643051 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062652111 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062694073 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062702894 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062762022 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062763929 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062813997 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062822104 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062875032 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.062881947 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062949896 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.062980890 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.063000917 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.063024998 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.063076973 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.063122988 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.063172102 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.063182116 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.063255072 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.112425089 CET	443	49805	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.112487078 CET	443	49805	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.112536907 CET	443	49805	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.112561941 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.112586975 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.112665892 CET	443	49805	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.112719059 CET	443	49805	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.112730980 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.112770081 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.113476038 CET	443	49805	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.113548994 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.118887901 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.119090080 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.119265079 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.119318962 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.119338989 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.119368076 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.119374990 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.119419098 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:03.119421959 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.119471073 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:03.122132063 CET	443	49806	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.122345924 CET	443	49806	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.122402906 CET	443	49806	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.122464895 CET	443	49806	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.122462988 CET	49806	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.122505903 CET	49806	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.122514009 CET	49806	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.122514009 CET	443	49806	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.122622013 CET	49806	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.123264074 CET	443	49806	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.123384953 CET	49806	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.142148018 CET	49806	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.244858980 CET	443	49805	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.244940996 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.245073080 CET	443	49805	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.245143890 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.268181086 CET	443	49806	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.268352985 CET	49806	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.790201902 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:03.790417910 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.834595919 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:03.837507010 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:03.837598085 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:03.837634087 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:03.837671995 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:03.837968111 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:03.838021994 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:03.838026047 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:03.838073969 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:03.838866949 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:03.838918924 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:03.838937998 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:03.838989973 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:03.839791059 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:03.839837074 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:03.839844942 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:03.839886904 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:03.916440010 CET	443	49805	3.214.78.220	192.168.2.3
Jan 30, 2021 12:51:03.916575909 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:51:03.933501005 CET	49809	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:03.933614016 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:03.980856895 CET	443	49809	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:03.980947971 CET	49809	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:03.980978012 CET	443	49810	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:03.981046915 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:03.981158018 CET	49809	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.000031948 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.026832104 CET	443	49809	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.028040886 CET	443	49809	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.028111935 CET	49809	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.028115034 CET	443	49809	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.028172016 CET	49809	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.028197050 CET	443	49809	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.028264046 CET	49809	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.036195993 CET	49790	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.045814037 CET	443	49810	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.047497988 CET	443	49810	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.047555923 CET	443	49810	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.047594070 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.047615051 CET	443	49810	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.047626019 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.047671080 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.055562019 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.060780048 CET	49809	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.073143959 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.073185921 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.073199987 CET	49811	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.073249102 CET	49809	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.073268890 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.091166973 CET	80	49790	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.091608047 CET	80	49790	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.091659069 CET	80	49790	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.091710091 CET	49790	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.091727018 CET	80	49790	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.091784954 CET	80	49790	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.091831923 CET	49790	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.091862917 CET	80	49790	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.091914892 CET	80	49790	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.091963053 CET	80	49790	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.091974020 CET	49790	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.092015982 CET	80	49790	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.092076063 CET	49790	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.101448059 CET	443	49810	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.101540089 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.113214970 CET	443	49811	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.113262892 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.113310099 CET	49811	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.113362074 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.113704920 CET	49811	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.113739967 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.116219997 CET	443	49809	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.116311073 CET	49809	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.118969917 CET	443	49810	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.119097948 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.119203091 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.119586945 CET	49790	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.119719982 CET	443	49810	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.119775057 CET	443	49810	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.119791031 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.119831085 CET	49810	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.120162010 CET	443	49809	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.120223999 CET	49809	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.137361050 CET	49809	443	192.168.2.3	151.101.12.157
Jan 30, 2021 12:51:04.155925989 CET	443	49811	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.156003952 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.156629086 CET	443	49811	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.156683922 CET	443	49811	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.156708956 CET	49811	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.156744957 CET	49811	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.156765938 CET	443	49811	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.156812906 CET	49811	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.158154964 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.158210993 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.158271074 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.158282042 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.158297062 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.158339024 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.176755905 CET	80	49790	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.194365978 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.194608927 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.194719076 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.209317923 CET	443	49810	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.231492996 CET	443	49809	151.101.12.157	192.168.2.3
Jan 30, 2021 12:51:04.236857891 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.236922979 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.236999035 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.237102985 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.237121105 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.237198114 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.237236977 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.237283945 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.237349033 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.237567902 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.237617016 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.237905979 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.237957001 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.237961054 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.238004923 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.238010883 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.238054037 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.238059998 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.238106012 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.238833904 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.238886118 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.238886118 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.238931894 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.239718914 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.239768982 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.239774942 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.239820957 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.240596056 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.240647078 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.240652084 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.240705967 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.241530895 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.241581917 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.241584063 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.241627932 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.242487907 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.242541075 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.242541075 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.242587090 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.243350983 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.243402004 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.243416071 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.243449926 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.244242907 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.244294882 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.244312048 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.244357109 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.244999886 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.245054007 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.245075941 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.245145082 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.245920897 CET	49813	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.267298937 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.274142027 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.278182030 CET	49811	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.278350115 CET	49811	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.304963112 CET	80	49813	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.305083990 CET	49813	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.314174891 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.318269014 CET	443	49811	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.318317890 CET	443	49811	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.318449974 CET	443	49811	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.318516970 CET	49811	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.318665981 CET	443	49811	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.318732977 CET	443	49811	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.318743944 CET	49811	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.318809986 CET	49811	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.323256969 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.323841095 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.323894024 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.323908091 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.323931932 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.323945999 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.323980093 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.323985100 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.324027061 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.339989901 CET	49813	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.353122950 CET	49811	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.393260956 CET	443	49811	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.397048950 CET	80	49813	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.397372961 CET	80	49813	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.397461891 CET	80	49813	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.397521973 CET	80	49813	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.397579908 CET	49813	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.397584915 CET	80	49813	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.397639990 CET	49813	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.397645950 CET	80	49813	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.397706985 CET	80	49813	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.397761106 CET	80	49813	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.397762060 CET	49813	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.397810936 CET	80	49813	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.397865057 CET	49813	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.419287920 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.419802904 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.420141935 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.420331955 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.437033892 CET	49780	443	192.168.2.3	52.217.98.3
Jan 30, 2021 12:51:04.437062025 CET	49781	443	192.168.2.3	52.217.98.3
Jan 30, 2021 12:51:04.475349903 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.475666046 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.475723982 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.475759983 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.475775957 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.475784063 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.475826025 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.475831032 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.475874901 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.475883007 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.475924015 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.475936890 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.475972891 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.475980043 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476022005 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476023912 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476069927 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476077080 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476119041 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476125002 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476166964 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476174116 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476214886 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476227999 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476255894 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476269007 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476304054 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476305962 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476351976 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476357937 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476401091 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476402998 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476449013 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476450920 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476497889 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476505041 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476546049 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476550102 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476593971 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476596117 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476643085 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476648092 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476689100 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476690054 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476738930 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476743937 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476787090 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476790905 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476835966 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476852894 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476880074 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476912022 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476928949 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.476936102 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476988077 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.476998091 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477036953 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477052927 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477086067 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477133989 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477134943 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477144003 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477169991 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477185965 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477212906 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477258921 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477272987 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477298975 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477346897 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477401018 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477428913 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477472067 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477492094 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477530003 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477534056 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477571011 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477583885 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477615118 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477622986 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477673054 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477673054 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477725029 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477727890 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477776051 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477777004 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477823019 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477826118 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477870941 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477871895 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477919102 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477921963 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.477967024 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.477969885 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478015900 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478020906 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478064060 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478069067 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478116035 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478116989 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478180885 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478189945 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478245020 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478267908 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478307009 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478321075 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478353977 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478363037 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478401899 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478406906 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478476048 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478514910 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478524923 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478527069 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478571892 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478574991 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478620052 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478621960 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478667021 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478672028 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478714943 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478718042 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478770971 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478787899 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478825092 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478828907 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478888035 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478888988 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478941917 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.478946924 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.478996038 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479002953 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479043961 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479053020 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479106903 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479113102 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479165077 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479171991 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479231119 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479233027 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479285955 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479290009 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479341984 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479348898 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479403019 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479408026 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479458094 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479465961 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479521036 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479525089 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479578972 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479584932 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479640961 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479645967 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479697943 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479703903 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479753971 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479758024 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479809999 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479814053 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479871035 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479873896 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479926109 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.479933023 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479993105 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.479995966 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.480046034 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.535938025 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536015987 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536048889 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536067009 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536073923 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536118984 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536123037 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536168098 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536185026 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536216974 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536223888 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536266088 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536273003 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536314964 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536360979 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536362886 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536370993 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536412001 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536448002 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536461115 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536463976 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536509037 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536508083 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536559105 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536581039 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536609888 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536609888 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536658049 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536678076 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536706924 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536717892 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536755085 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536775112 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536807060 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536809921 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536854982 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536859989 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536905050 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536906958 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536952972 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.536962986 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.536967039 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.537000895 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537014008 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537049055 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537050962 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537098885 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537100077 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537147045 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537156105 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537199020 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537251949 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537302017 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537308931 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537349939 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537350893 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537429094 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537453890 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537477970 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537509918 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537528038 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537580967 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537605047 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537656069 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537676096 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537704945 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537712097 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537771940 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537791967 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537842989 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537867069 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537892103 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537940979 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.537972927 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537981033 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.537986040 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538017988 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538067102 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538080931 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538115025 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538117886 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538162947 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538171053 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538211107 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538217068 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538259983 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538263083 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538307905 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538311005 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538355112 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538361073 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538403034 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538410902 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538450956 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538453102 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538497925 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538503885 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538546085 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538552046 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538594007 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538602114 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538642883 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538642883 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538692951 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538702011 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538717985 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538749933 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538753033 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538803101 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538810968 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538851976 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538853884 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538898945 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538906097 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538948059 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.538950920 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.538996935 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539000988 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539045095 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539055109 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539093971 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539098978 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539141893 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539146900 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539195061 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539196014 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539249897 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539252043 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539303064 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539308071 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539352894 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539359093 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539401054 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539406061 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539449930 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539454937 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539498091 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539500952 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539546013 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539550066 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539593935 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539603949 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539644003 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539647102 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539693117 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539700985 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539741039 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539751053 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539792061 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539794922 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539839983 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539845943 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539887905 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539897919 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539936066 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539937019 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.539983988 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.539990902 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540050983 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540051937 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540107012 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540153027 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540208101 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540213108 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540266991 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540273905 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540337086 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540342093 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540389061 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540395975 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540435076 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540441036 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540482044 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540487051 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540528059 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540534019 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540575027 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540580988 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540622950 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540628910 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540668964 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540674925 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540715933 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540725946 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540764093 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540770054 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540811062 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540818930 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540858030 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540863991 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540904999 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540910006 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540951014 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.540958881 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.540999889 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541007042 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541045904 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541050911 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541093111 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541096926 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541140079 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541146040 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541186094 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541192055 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541232109 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541239023 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541279078 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541284084 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541325092 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541330099 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541373014 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541378021 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541426897 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541440010 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541481018 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541493893 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541520119 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541532993 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541558981 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541570902 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541596889 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541609049 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541635990 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541647911 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541673899 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541690111 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541711092 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541724920 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541749954 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541764021 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541789055 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541800976 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541826963 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541841984 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541865110 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541879892 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541903019 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541918039 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541940928 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541955948 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.541980028 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.541991949 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.542017937 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.542028904 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.542057037 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.542069912 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.542094946 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.542109966 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.542134047 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.542146921 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.542172909 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.542185068 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.542224884 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.589173079 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.589238882 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.589255095 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.589309931 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.589473963 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.589525938 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.589534998 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.589580059 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.590431929 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.590486050 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.590492964 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.590542078 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.591312885 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.591365099 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.591397047 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.591423035 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.592231989 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.592289925 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.592310905 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.592350960 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.593178034 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.593239069 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.593249083 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.593288898 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.594077110 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.594130039 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.594151020 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.594187975 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.594933033 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.594949961 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.595010996 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.595019102 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.595078945 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.595851898 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.595910072 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.596086025 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.596147060 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.596801043 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.596857071 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.596857071 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.596915007 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.597714901 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.597769976 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.597788095 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.597831964 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.598181009 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.598233938 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.598253965 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.598284006 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.598288059 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.598332882 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.598341942 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.598380089 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.598385096 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.598428965 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.598431110 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.598475933 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.598481894 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.598525047 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.598529100 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.598568916 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.598572969 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.598628044 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.598645926 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.598697901 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.598701954 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.598763943 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.598772049 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.598823071 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.599555969 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.599610090 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.599630117 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.599669933 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.600418091 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.600472927 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.600486994 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.600526094 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.601311922 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.601363897 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.601373911 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.601408958 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.602242947 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.602294922 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.602296114 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.602349997 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.603154898 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.603209019 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.603225946 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.603264093 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.604057074 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.604108095 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.604113102 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.604157925 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.604948997 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.605009079 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.605019093 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.605062962 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.605881929 CET	443	49773	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:04.605953932 CET	49773	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:04.618102074 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.618289948 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.619119883 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.619168043 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.619343996 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.619496107 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.619738102 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.620079041 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.620240927 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.635107040 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.635164022 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.635236979 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.635828972 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.635890961 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.635997057 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.636054993 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.636415958 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.636472940 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.636477947 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.636531115 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.637367964 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.637445927 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.637778997 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.637855053 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.638269901 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.638319016 CET	443	49812	31.13.92.14	192.168.2.3
Jan 30, 2021 12:51:04.638329029 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.638369083 CET	49812	443	192.168.2.3	31.13.92.14
Jan 30, 2021 12:51:04.653115034 CET	49813	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.654756069 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.654829025 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.654891968 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.654911995 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.654926062 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.654942989 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.654953003 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.655009985 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.655013084 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.655066967 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.655073881 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.655127048 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.655138969 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.655193090 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.655200005 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.655249119 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.674267054 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.674321890 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.674948931 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.674997091 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.675362110 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.675429106 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.675643921 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.675951958 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.676100969 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.708403111 CET	80	49765	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.708487988 CET	49765	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.710202932 CET	80	49813	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.711158037 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.711239100 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.711246014 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.711302996 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.711308956 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.711349010 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.711353064 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.711417913 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.711421967 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.711472034 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.711474895 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.711519957 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.711520910 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.711570024 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.711574078 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.711621046 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.756794930 CET	49815	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.759732962 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:04.770093918 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.770189047 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.770204067 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.770257950 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.770282030 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.770351887 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.770354033 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.770402908 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.770411015 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.770478010 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.770494938 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.770549059 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.770566940 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.770620108 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.770628929 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.770672083 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.799669981 CET	49817	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:51:04.813322067 CET	80	49815	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.813422918 CET	49815	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.826740026 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.826795101 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.826813936 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.826844931 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.826845884 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.826895952 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.826900959 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.826945066 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.826946020 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.826993942 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.826997042 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.827042103 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.827043056 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.827090025 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.827091932 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.827140093 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.827142954 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.827188969 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.827194929 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.827236891 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.827238083 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.827285051 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.827287912 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.827332973 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.827333927 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.827384949 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.844033957 CET	49818	80	192.168.2.3	67.215.246.203
Jan 30, 2021 12:51:04.844106913 CET	49815	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.852607965 CET	80	49817	178.79.242.181	192.168.2.3
Jan 30, 2021 12:51:04.852783918 CET	49817	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:51:04.883348942 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.883415937 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.883441925 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.883477926 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.883495092 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.883531094 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.883538961 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.883599997 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.883601904 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.883660078 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.883661032 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.883721113 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.883729935 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.883778095 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.883780956 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.883837938 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.883842945 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.883898020 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.883903980 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.883959055 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.883964062 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884015083 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884025097 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884082079 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884085894 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884150982 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884177923 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884231091 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884232044 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884279966 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884299040 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884344101 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884351969 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884419918 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884434938 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884502888 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884511948 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884562969 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884566069 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884612083 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884617090 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884660006 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884663105 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884707928 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884710073 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884757042 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884762049 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884809971 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884815931 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884857893 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.884860992 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.884907007 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.885407925 CET	49817	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:51:04.889023066 CET	443	49816	54.208.194.17	192.168.2.3
Jan 30, 2021 12:51:04.889142990 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:04.898247957 CET	80	49815	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.898322105 CET	80	49815	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.898382902 CET	80	49815	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.898459911 CET	80	49815	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.898494005 CET	49815	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.898538113 CET	80	49815	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.898600101 CET	49815	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.898639917 CET	80	49815	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.898690939 CET	80	49815	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.898787975 CET	80	49815	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.898804903 CET	49815	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.898870945 CET	80	49815	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.898919106 CET	49815	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.900441885 CET	49815	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:04.938426971 CET	80	49817	178.79.242.181	192.168.2.3
Jan 30, 2021 12:51:04.938895941 CET	80	49817	178.79.242.181	192.168.2.3
Jan 30, 2021 12:51:04.938951015 CET	80	49817	178.79.242.181	192.168.2.3
Jan 30, 2021 12:51:04.939001083 CET	80	49817	178.79.242.181	192.168.2.3
Jan 30, 2021 12:51:04.939018965 CET	49817	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:51:04.939049959 CET	80	49817	178.79.242.181	192.168.2.3
Jan 30, 2021 12:51:04.939059019 CET	49817	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:51:04.939064980 CET	49817	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:51:04.939095974 CET	49817	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:51:04.939105988 CET	80	49817	178.79.242.181	192.168.2.3
Jan 30, 2021 12:51:04.939155102 CET	80	49817	178.79.242.181	192.168.2.3
Jan 30, 2021 12:51:04.939156055 CET	49817	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:51:04.939197063 CET	80	49817	178.79.242.181	192.168.2.3
Jan 30, 2021 12:51:04.939208984 CET	49817	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:51:04.939249992 CET	49817	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:51:04.940748930 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.940800905 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.940826893 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.940851927 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.940884113 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.940905094 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.940936089 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.940953970 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941005945 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941016912 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941046953 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941117048 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941118002 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941184044 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941188097 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941243887 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941263914 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941323042 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941338062 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941386938 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941402912 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941463947 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941464901 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941509962 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941514015 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941562891 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941570997 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941611052 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941612959 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941658974 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941660881 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941706896 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941709995 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941755056 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941760063 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941802979 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941806078 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941854000 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941855907 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941901922 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941905022 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.941951036 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.941953897 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942001104 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942002058 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942049026 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942049980 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942097902 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942100048 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942147017 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942148924 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942195892 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942199945 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942244053 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942246914 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942292929 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942305088 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942341089 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942344904 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942389011 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942394972 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942436934 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942444086 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942504883 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942504883 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942553997 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942555904 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942601919 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942608118 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942651033 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942652941 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942699909 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942703962 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942749023 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942753077 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942796946 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942799091 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942847013 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942847967 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942894936 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942898989 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942944050 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942946911 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.942991972 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.942998886 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.943039894 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.943042994 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.943088055 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.943094969 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.943136930 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.943142891 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.943185091 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.943186998 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.943233013 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.943238020 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.943280935 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.943285942 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.943327904 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.943346024 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.943377018 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.943380117 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.943425894 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:04.943428040 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.943475962 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:04.955703974 CET	80	49815	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:04.982943058 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:05.001574039 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.001633883 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.001686096 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.001703978 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.001724005 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.001737118 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.001765013 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.001785994 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.001801014 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.001832008 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.001837969 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.001887083 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.001897097 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.001935959 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.001940966 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.001983881 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.001998901 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002038002 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002257109 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.002320051 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.002327919 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002371073 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002379894 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.002439976 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.002440929 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002496004 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002500057 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.002559900 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.002567053 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002618074 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002619028 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.002675056 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002677917 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.002737999 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002739906 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.002794027 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002799034 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.002852917 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002861023 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.002921104 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.002922058 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002974033 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.002981901 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003035069 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003041983 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003093958 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003102064 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003149033 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003161907 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003216028 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003221989 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003274918 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003281116 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003333092 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003340960 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003393888 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003401041 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003454924 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003459930 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003514051 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003520012 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003571033 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003580093 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003631115 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003638983 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003691912 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003699064 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003757000 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003760099 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003818989 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003819942 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003871918 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003880978 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003935099 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.003941059 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.003993988 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004000902 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004055023 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004060984 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004113913 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004120111 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004173040 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004182100 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004234076 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004242897 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004295111 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004304886 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004359007 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004363060 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004420042 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004422903 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004477978 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004482985 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004539967 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004542112 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004595041 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004601955 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004658937 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004662037 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004733086 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004734993 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004784107 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004790068 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004834890 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004837990 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004884005 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004887104 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004931927 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004931927 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.004981041 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.004985094 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005028963 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005034924 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005076885 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005079985 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005125999 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005129099 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005173922 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005176067 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005223036 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005223989 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005271912 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005279064 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005321026 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005326033 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005368948 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005372047 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005419016 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005449057 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005501986 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005506039 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005549908 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005553961 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005599022 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005604982 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005647898 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005650043 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005695105 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005700111 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005744934 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005752087 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005794048 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005804062 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005844116 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005850077 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005892992 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005894899 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005942106 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005949020 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.005990028 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.005995035 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006038904 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006048918 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006088018 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006098032 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006136894 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006141901 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006186008 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006191015 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006234884 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006234884 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006282091 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006288052 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006330967 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006340981 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006386042 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006465912 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006517887 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006522894 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006567001 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006572008 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006617069 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006620884 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006664991 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006669044 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006712914 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006716967 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006761074 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006764889 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006809950 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006819010 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006860018 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006865978 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006908894 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006911039 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.006957054 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.006963015 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.007004976 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.007009983 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.007052898 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.007059097 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.007101059 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.007105112 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.007148981 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.007153988 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.007198095 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.007204056 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.007250071 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.016644955 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.016777039 CET	49820	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.021279097 CET	80	49818	67.215.246.203	192.168.2.3
Jan 30, 2021 12:51:05.021382093 CET	49818	80	192.168.2.3	67.215.246.203
Jan 30, 2021 12:51:05.031089067 CET	49821	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:05.031212091 CET	49818	80	192.168.2.3	67.215.246.203
Jan 30, 2021 12:51:05.056934118 CET	443	49819	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.057038069 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.057308912 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.058557987 CET	443	49820	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.058662891 CET	49820	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.058864117 CET	49820	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.063103914 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063158035 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063182116 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063205957 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063208103 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063256979 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063271999 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063306093 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063321114 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063354969 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063354969 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063402891 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063409090 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063451052 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063452005 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063502073 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063508034 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063550949 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063560963 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063599110 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063602924 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063647032 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063666105 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063697100 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063710928 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063745975 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063754082 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063793898 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063802958 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063844919 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063848019 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063893080 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063895941 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063941002 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063941002 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.063988924 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.063991070 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064037085 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064049959 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064085007 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064094067 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064133883 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064136028 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064182043 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064186096 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064230919 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064232111 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064280033 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064296007 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064328909 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064338923 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064377069 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064385891 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064426899 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064440966 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064475060 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064485073 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064523935 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064527988 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064572096 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064587116 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064620972 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064624071 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064668894 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064697027 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064717054 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064733982 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064765930 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064765930 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064815044 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064842939 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064865112 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064866066 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064913034 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064923048 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.064961910 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.064981937 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065011024 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065035105 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065058947 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065062046 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065107107 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065120935 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065155983 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065159082 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065203905 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065218925 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065253973 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065258980 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065300941 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065309048 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065349102 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065360069 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065423012 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065432072 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065481901 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065495014 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065537930 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065541029 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065598965 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065601110 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065651894 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065660954 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065720081 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065720081 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065777063 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065779924 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065845966 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065845966 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065906048 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065907001 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.065964937 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.065970898 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066025019 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066036940 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066081047 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066085100 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066144943 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066150904 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066205025 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066220045 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066260099 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066263914 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066324949 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066329956 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066385031 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066386938 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066446066 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066452026 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066502094 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066504955 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066557884 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066564083 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066620111 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066622972 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066678047 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066683054 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066740036 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066742897 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066797018 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066802979 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066895962 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066936016 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.066951036 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.066951036 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.067001104 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.067003965 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.067049026 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.067054987 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.067100048 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.067101955 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.067148924 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.067156076 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.067197084 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.067202091 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.067244053 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.067250967 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.067292929 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.067296982 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.067342043 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.067349911 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.067389965 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.067420006 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.067442894 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.067926884 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068007946 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068023920 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068075895 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068085909 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068125010 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068134069 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068173885 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068178892 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068223000 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068228006 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068259954 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068288088 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068358898 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068396091 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068430901 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068439007 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068480015 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068486929 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068527937 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068528891 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068574905 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068581104 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068624020 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068629980 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068679094 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068695068 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068753004 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068753958 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068816900 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068820953 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068880081 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.068881989 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.068973064 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069020033 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069029093 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069031000 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069077969 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069081068 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069133997 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069170952 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069191933 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069228888 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069283009 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069307089 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069361925 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069364071 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069420099 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069441080 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069498062 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069509029 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069586992 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069619894 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069679976 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069688082 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069740057 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069744110 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069797993 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069802999 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069855928 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069864035 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069920063 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069924116 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.069977999 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.069983959 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070036888 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070043087 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070096016 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070103884 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070156097 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070163012 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070219994 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070240974 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070293903 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070300102 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070343971 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070349932 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070393085 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070395947 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070441961 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070455074 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070491076 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070501089 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070538998 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070542097 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070591927 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070601940 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070645094 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070650101 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070703983 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070705891 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070753098 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070758104 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070801973 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070804119 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070852995 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070854902 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070909023 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.070914984 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070972919 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.070981026 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071034908 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071043015 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071089029 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071094036 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071149111 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071182013 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071232080 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071240902 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071297884 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071300983 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071353912 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071382999 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071430922 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071436882 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071480989 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071482897 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071518898 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071546078 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071594954 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071676970 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071696997 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071706057 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071729898 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071737051 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071789980 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071795940 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071851969 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071856022 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071942091 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.071986914 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.071995020 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.072000027 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.072057009 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.072663069 CET	49823	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.072740078 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.087975025 CET	80	49821	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:05.088094950 CET	49821	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:05.097332001 CET	443	49819	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.098932028 CET	443	49820	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.099288940 CET	443	49819	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.099340916 CET	443	49819	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.099373102 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.099385977 CET	443	49819	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.099421024 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.099428892 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.100790977 CET	443	49820	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.100851059 CET	443	49820	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.100874901 CET	49820	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.100905895 CET	443	49820	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.100924015 CET	49820	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.100960970 CET	49820	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.109607935 CET	443	49816	54.208.194.17	192.168.2.3
Jan 30, 2021 12:51:05.109752893 CET	443	49816	54.208.194.17	192.168.2.3
Jan 30, 2021 12:51:05.109805107 CET	443	49816	54.208.194.17	192.168.2.3
Jan 30, 2021 12:51:05.109827042 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:05.109869003 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:05.109944105 CET	443	49816	54.208.194.17	192.168.2.3
Jan 30, 2021 12:51:05.109992981 CET	443	49816	54.208.194.17	192.168.2.3
Jan 30, 2021 12:51:05.110017061 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:05.110044956 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:05.111469030 CET	443	49816	54.208.194.17	192.168.2.3
Jan 30, 2021 12:51:05.111547947 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:05.114140034 CET	443	49823	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.114177942 CET	443	49822	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.114264965 CET	49823	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.114343882 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.119477987 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.121104002 CET	49823	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.124577045 CET	49821	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:05.128066063 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128114939 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128151894 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128170013 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128196001 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128197908 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128216028 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128241062 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128262043 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128278017 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128298998 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128314972 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128340960 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128353119 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128360987 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128388882 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128407001 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128427029 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128448009 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128480911 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128485918 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128542900 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128566980 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128628969 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128659964 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128727913 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128806114 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128828049 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:05.128849030 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.128890991 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128914118 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.128981113 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129070044 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129093885 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129132032 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129151106 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129169941 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129183054 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129206896 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129244089 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129260063 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129280090 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129304886 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129318953 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129344940 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129364967 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129380941 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129435062 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129445076 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129477024 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129514933 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129524946 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129538059 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129551888 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129580975 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129589081 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129611969 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129635096 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129645109 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129683971 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129694939 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129722118 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129745007 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129760981 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129793882 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129797935 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129811049 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129836082 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129853010 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129873991 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129880905 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129910946 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129933119 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129957914 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.129972935 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.129998922 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130012035 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130034924 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130049944 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130072117 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130095005 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130108118 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130141973 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130143881 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130155087 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130181074 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130207062 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130218029 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130256891 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130264997 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130270958 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130307913 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130321026 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130345106 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130362034 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130383015 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130395889 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130419016 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130441904 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130454063 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130491018 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130491018 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130506992 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130527020 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130541086 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130573988 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130580902 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130614042 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130628109 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130650997 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130666971 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130688906 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130705118 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130724907 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130740881 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130760908 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130780935 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130798101 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130811930 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130836010 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130850077 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130882025 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130889893 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130924940 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130939960 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130960941 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.130975962 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.130997896 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131017923 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131035089 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131048918 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131069899 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131088018 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131107092 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131144047 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131150007 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131176949 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131190062 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131196022 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131232023 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131244898 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131268024 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131282091 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131304979 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131320000 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131342888 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131359100 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131377935 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131392002 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131413937 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131432056 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131449938 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131479979 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131496906 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131499052 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131536961 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131553888 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131572962 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131588936 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131611109 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131628990 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131647110 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131665945 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131683111 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131700039 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131719112 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131733894 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131755114 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131772995 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131803036 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131819963 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131845951 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131860018 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131881952 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131901026 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131920099 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131933928 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131957054 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.131975889 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.131993055 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.132010937 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.132030010 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.132044077 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.132066965 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.132081985 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.132113934 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.132119894 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.132169008 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.140491962 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.140650034 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.140743017 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.162358046 CET	443	49822	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.163888931 CET	443	49822	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.163933992 CET	443	49822	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.163963079 CET	443	49822	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.164021969 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.164050102 CET	443	49823	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.164051056 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.164057970 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.165189028 CET	443	49823	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.165237904 CET	443	49823	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.165252924 CET	49823	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.165272951 CET	443	49823	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.165288925 CET	49823	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.165319920 CET	49823	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.182986021 CET	443	49819	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.183021069 CET	443	49819	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.183046103 CET	443	49819	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.183264971 CET	443	49819	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.183291912 CET	443	49819	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.183331966 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.183368921 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.183590889 CET	443	49819	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.183655977 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.184324980 CET	80	49821	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:05.184777975 CET	80	49821	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:05.184818983 CET	80	49821	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:05.184871912 CET	80	49821	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:05.184910059 CET	49821	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:05.184914112 CET	80	49821	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:05.184953928 CET	80	49821	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:05.184969902 CET	49821	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:05.185003042 CET	80	49821	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:05.185038090 CET	80	49821	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:05.185056925 CET	49821	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:05.185064077 CET	80	49821	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:05.185127020 CET	49821	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:05.186578035 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.186702967 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.186815977 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.190052986 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.190095901 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.190136909 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.190174103 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.190284014 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.190347910 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.190957069 CET	49821	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:05.192137003 CET	49823	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.192362070 CET	49823	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.193485022 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.193562984 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.208271980 CET	80	49818	67.215.246.203	192.168.2.3
Jan 30, 2021 12:51:05.210161924 CET	80	49818	67.215.246.203	192.168.2.3
Jan 30, 2021 12:51:05.210191011 CET	80	49818	67.215.246.203	192.168.2.3
Jan 30, 2021 12:51:05.210268974 CET	49818	80	192.168.2.3	67.215.246.203
Jan 30, 2021 12:51:05.216547966 CET	49818	80	192.168.2.3	67.215.246.203
Jan 30, 2021 12:51:05.228905916 CET	443	49822	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.228945971 CET	443	49822	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.228974104 CET	443	49822	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.229001045 CET	443	49822	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.229104042 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.229123116 CET	443	49822	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.229131937 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.229183912 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.229218960 CET	443	49822	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.235268116 CET	443	49823	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.235295057 CET	443	49823	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.235768080 CET	443	49823	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.235851049 CET	49823	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.235873938 CET	443	49823	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.235898018 CET	443	49823	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.235924006 CET	49823	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.235943079 CET	49823	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.249253035 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.249303102 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.249327898 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.249341011 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.249362946 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.249412060 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.250462055 CET	80	49821	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:05.252410889 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.252480030 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.261595011 CET	443	49816	54.208.194.17	192.168.2.3
Jan 30, 2021 12:51:05.261679888 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:05.275259972 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:05.275635958 CET	49823	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.275921106 CET	49820	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.276091099 CET	49820	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.281454086 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.289113045 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.290297985 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:05.292382956 CET	443	49819	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.292454004 CET	49819	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.305474043 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.305517912 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.305555105 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.305588007 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.305624962 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.308774948 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.308828115 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.308854103 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.315934896 CET	443	49823	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.316117048 CET	443	49820	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.316147089 CET	443	49820	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.316371918 CET	443	49820	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.316402912 CET	443	49820	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.316447973 CET	49820	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.316485882 CET	49820	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.316565990 CET	443	49820	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.316622019 CET	49820	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.321611881 CET	443	49819	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.329199076 CET	443	49822	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.341646910 CET	443	49822	104.244.42.69	192.168.2.3
Jan 30, 2021 12:51:05.341770887 CET	49822	443	192.168.2.3	104.244.42.69
Jan 30, 2021 12:51:05.361574888 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.361619949 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.361782074 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.362057924 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.364909887 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.364950895 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.364989996 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.365019083 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.393840075 CET	80	49818	67.215.246.203	192.168.2.3
Jan 30, 2021 12:51:05.416939020 CET	443	49816	54.208.194.17	192.168.2.3
Jan 30, 2021 12:51:05.417877913 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.417921066 CET	443	49816	54.208.194.17	192.168.2.3
Jan 30, 2021 12:51:05.417967081 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.417999029 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:05.418092012 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.418154001 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.420981884 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.421020985 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.421061993 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.421086073 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.474049091 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.474101067 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.474216938 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.474237919 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.477102995 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.477144957 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.477227926 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.477248907 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.532788992 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.532838106 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.532906055 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.532932997 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.535340071 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.535379887 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.535404921 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.535450935 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.592120886 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.592160940 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.592231989 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.592255116 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.594774008 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.594814062 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.594860077 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.594894886 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.650698900 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.650744915 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.650872946 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.650908947 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.653356075 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.653428078 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.653435946 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.653491974 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.706991911 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.707042933 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.707088947 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.707120895 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.709348917 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.709429979 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.709498882 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.709553957 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.728893042 CET	49820	443	192.168.2.3	104.244.42.131
Jan 30, 2021 12:51:05.763148069 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.763206005 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.763217926 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.763261080 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.765455961 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.765496016 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.765533924 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.765559912 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.769100904 CET	443	49820	104.244.42.131	192.168.2.3
Jan 30, 2021 12:51:05.791786909 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:05.819272041 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.819365025 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.819382906 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.819432974 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.821526051 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.821569920 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.821589947 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.821613073 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.836687088 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:05.836900949 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:05.875699043 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.875752926 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.875813007 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.875852108 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.878185987 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.878268957 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.878335953 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.878393888 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.908639908 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:05.933059931 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.933113098 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.933130026 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.933161974 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.935591936 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.935636044 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.935658932 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.935687065 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.955888033 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:05.956091881 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:05.956132889 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:05.956168890 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:05.956172943 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:05.956196070 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:05.956237078 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:05.958410025 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:05.958475113 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:05.991458893 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.991539001 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.991569996 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.991600990 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.994240999 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.994294882 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:05.994328022 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:05.994363070 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.050029993 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.050097942 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.050278902 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.050333977 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.053149939 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.053190947 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.053208113 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.053239107 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.085639954 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.108653069 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.108705997 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.108733892 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.108768940 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.111325026 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.111406088 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.111419916 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.111481905 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.132457018 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.132575989 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.132683992 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.132709980 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.132714987 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.132733107 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.132750034 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.132778883 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.132884979 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.132931948 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.167408943 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.167460918 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.167480946 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.167555094 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.170067072 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.170108080 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.170146942 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.170175076 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.223540068 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.223594904 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.223670006 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.223702908 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.226380110 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.226422071 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.226461887 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.226489067 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.281570911 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.281630039 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.281682968 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.281723022 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.282335997 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.282378912 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.282407045 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.282483101 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.337733030 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.337791920 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.337874889 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.337923050 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.338377953 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.338418961 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.338455915 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.338479996 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.396100998 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.396152973 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.396193981 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.396239996 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.396275043 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.396653891 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.396718979 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.454406023 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.454462051 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.454502106 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.454507113 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.454531908 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.454540014 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.454554081 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.454607010 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.510521889 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.510572910 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.510612965 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.510649920 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.510653019 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.510674953 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.510708094 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.566756964 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.566822052 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.566864967 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.566886902 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.566901922 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.566911936 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.566916943 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.566961050 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.613982916 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.614012957 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.614084005 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.615986109 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:06.616467953 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.616871119 CET	49827	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:06.623817921 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.623864889 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.623895884 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.623913050 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.623917103 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.623956919 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.623970985 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.624008894 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.630229950 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.632278919 CET	49769	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.655985117 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:06.656100988 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:06.658137083 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.658178091 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.658206940 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.658232927 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.658299923 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.659219980 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.659260988 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.659291029 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.659297943 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.659311056 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.659334898 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.659351110 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.659404039 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.660490036 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.660531998 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.660567045 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.660598040 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.661720037 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.661770105 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.661786079 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.661827087 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.662997961 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.663045883 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.663058043 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.663109064 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.664249897 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.664288998 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.664311886 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.664340973 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.665508032 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.665550947 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.665582895 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.665606022 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.666783094 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.666846037 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.669358015 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.669498920 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.671791077 CET	80	49827	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:06.671900988 CET	49827	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:06.680032969 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.680089951 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.680109024 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.680126905 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.680133104 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.680166006 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.680181026 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.680217981 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.685406923 CET	443	49769	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.686331987 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.686419964 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.735892057 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.736068964 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.736114979 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.736143112 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.736151934 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.736167908 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.736196041 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.736201048 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.736258030 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.780507088 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.783092022 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.783130884 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.783190012 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.783230066 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.783701897 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.783741951 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.783777952 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.783802032 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.784981966 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.785023928 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.785048008 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.785073042 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.786256075 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.786297083 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.786334991 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.786356926 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.787483931 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.787523031 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.787559032 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.787579060 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.788752079 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.788791895 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.788817883 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.788841009 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.790004015 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.790044069 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.790067911 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.790097952 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.791279078 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.791318893 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.791343927 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.791363955 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.792284966 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.792323112 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.792355061 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.792370081 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.792380095 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.792412043 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.792421103 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.792468071 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.792546988 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.792582989 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.792602062 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.792627096 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.793847084 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.793912888 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.793957949 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.794014931 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.795061111 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.795100927 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.795119047 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.795142889 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.796350956 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.796390057 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.796422005 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.796448946 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.797646046 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.797686100 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.797727108 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.797749996 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.798901081 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.798952103 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.798971891 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.799001932 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.800090075 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.800132036 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.800168037 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.800188065 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.801368952 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.801433086 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.801449060 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.801498890 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.802681923 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.802722931 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.802767038 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.802846909 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.803869963 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.803911924 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.803945065 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.803967953 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.805149078 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.805190086 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.805216074 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.805239916 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.806391954 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.806432962 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.806459904 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.806483984 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.829503059 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.829555035 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.829580069 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.829617977 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.830003023 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.830044985 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.830073118 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.830128908 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.831295013 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.831334114 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.831373930 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.831392050 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.832540989 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.832581043 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.832598925 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.832628965 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.833832979 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.833873034 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.833893061 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.833921909 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.835047960 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.835088015 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.835103989 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.835141897 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.836350918 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.836410046 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.836427927 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.836482048 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.837591887 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.837631941 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.837652922 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.837677002 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.838823080 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.838861942 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.838876009 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.838917017 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.840074062 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.840112925 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.840140104 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.840162039 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.841353893 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.841401100 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.841415882 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.841459036 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.848289967 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.848332882 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.848362923 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.848385096 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.848390102 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.848423958 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.848438025 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.848475933 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.904459953 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.904517889 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.904556036 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.904573917 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.904597998 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.904602051 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.904608965 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.904654026 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.920667887 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.961539984 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.961589098 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.961627007 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.961632967 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.961657047 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.961668968 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:06.961694956 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.961734056 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.962286949 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:06.962430954 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:06.962435007 CET	49827	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:06.969810963 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.969851017 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.969907045 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.970191002 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.970232964 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.970237970 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.970279932 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.970285892 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.970858097 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.970906973 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.970918894 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.970961094 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.971635103 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.971666098 CET	443	49824	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:06.971709013 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:06.972980976 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:07.003705978 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.005281925 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.005333900 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.005398035 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.011142015 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.016700983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.017225027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.017281055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.017323971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.017364025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.017419100 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.017445087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.017458916 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.017496109 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.017537117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.017553091 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.017575026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.017649889 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.017695904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.017745018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.017800093 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.017843962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.017990112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018034935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018054962 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.018239021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018312931 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.018340111 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018378019 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018416882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018452883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018469095 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.018490076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018528938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018531084 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.018567085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018580914 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.018615961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018657923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018695116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018697977 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.018726110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018748045 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.018764973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018800974 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018837929 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.018838882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018877983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018892050 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.018925905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.018968105 CET	80	49827	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:07.018991947 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.019006968 CET	80	49827	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:07.019053936 CET	80	49827	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:07.019094944 CET	80	49827	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:07.019131899 CET	80	49827	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:07.019150019 CET	49827	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:07.019171000 CET	80	49827	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:07.019181013 CET	49827	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:07.019208908 CET	80	49827	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:07.019237995 CET	80	49827	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:07.019262075 CET	49827	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:07.019264936 CET	80	49827	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:07.019301891 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.019318104 CET	49827	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:07.019351006 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.019367933 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.019392967 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.019407988 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.019431114 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.019454956 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.019488096 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.051120043 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.051551104 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.068670034 CET	49827	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:07.073465109 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.073508024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.073555946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.073597908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.073637009 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.073678970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.073684931 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.073717117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.073734045 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.073740005 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.073756933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.073796034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.073827028 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.073847055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.073894978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.073896885 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.073939085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.073976994 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.073995113 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.074018955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074055910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074070930 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.074095011 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074131966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074146986 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.074171066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074218035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074222088 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.074260950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074297905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074312925 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.074337006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074374914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074392080 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.074412107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074449062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074486017 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.074508905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074556112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074562073 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.074598074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074634075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074680090 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.074790001 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074836016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074843884 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.074875116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074913025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.074927092 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.074951887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075001001 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075006008 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.075042963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075079918 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075094938 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.075119972 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075156927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075174093 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.075193882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075231075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075246096 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.075267076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075314045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075318098 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.075356007 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075392008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075407028 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.075431108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075468063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075484991 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.075505972 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075562000 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.075887918 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.075962067 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.076016903 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.076059103 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.076075077 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.076097965 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.076113939 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.076162100 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.100148916 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.123687029 CET	80	49827	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:07.128465891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.128508091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.128549099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.128587008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.128624916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.128663063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.128689051 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.128701925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.128730059 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.128735065 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.128751993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.128796101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.128823042 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.128834963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.128875017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.128897905 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.128912926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.128948927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.128974915 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.128997087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129034996 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129057884 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.129072905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129110098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129132032 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.129148006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129195929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129213095 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.129240990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129276991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129302979 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.129317045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129354954 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129379034 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.129440069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129477978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129512072 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.129517078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129559040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129585981 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.129607916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129648924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129671097 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.129687071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129724979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129745960 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.129762888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129798889 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129822969 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.129837990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129874945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129898071 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.129925013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.129972935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.130008936 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.130018950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.130062103 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.130084038 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.130100965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.130136967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.130162001 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.130176067 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.130213022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.130237103 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.130259991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.130301952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.130322933 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.130338907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.130377054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.130398989 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.130414963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.130485058 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.132249117 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.132291079 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.132349014 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.132365942 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.132374048 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.132410049 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.132427931 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.132483959 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.140232086 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166002989 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166044950 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166091919 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166111946 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.166126013 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166162014 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166194916 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.166202068 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166229963 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166248083 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.166269064 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166306973 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166315079 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.166343927 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166392088 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166416883 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.166433096 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166480064 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.166532040 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166610956 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166654110 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166657925 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.166692019 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166734934 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.166805983 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166925907 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.166975021 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.167020082 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167058945 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167094946 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167108059 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.167133093 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167170048 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167170048 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.167217016 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167258024 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167272091 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.167294979 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167331934 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167341948 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.167383909 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167412996 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167452097 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167453051 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.167490005 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167505980 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.167526007 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167571068 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167598009 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.167627096 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.167746067 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.185009003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185064077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185143948 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.185437918 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185478926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185516119 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185534000 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.185553074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185590029 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185595036 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.185627937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185674906 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185676098 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.185718060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185755014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185770035 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.185795069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185833931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185839891 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.185868979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185905933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185920000 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.185942888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185990095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.185992002 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.186033010 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186069965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186084032 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.186106920 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186142921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186157942 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.186178923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186216116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186225891 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.186254025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186297894 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.186300039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186342001 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186378002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186391115 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.186414957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186453104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186460972 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.186490059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186527014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186532974 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.186566114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186610937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186614037 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.186651945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186687946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186703920 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.186726093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186763048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186772108 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.186799049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186836004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186846972 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.186873913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186919928 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.186919928 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.186964035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.187010050 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.187011003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.187050104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.187086105 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.187100887 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.187123060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.187160969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.187166929 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.187199116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.187269926 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.190149069 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.190212011 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.190244913 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.190318108 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.190649986 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.190690041 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.190706015 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.190728903 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.238313913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.246301889 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.246355057 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.246391058 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.246428013 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.246679068 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.246718884 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.246737957 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.246768951 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.275959969 CET	49825	443	192.168.2.3	104.16.236.79
Jan 30, 2021 12:51:07.302551031 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.302623987 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.302701950 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.302741051 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.302756071 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.302795887 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.302874088 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.302927971 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.316010952 CET	443	49825	104.16.236.79	192.168.2.3
Jan 30, 2021 12:51:07.327995062 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.359085083 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.359137058 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.359174013 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.359193087 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.359210968 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.359216928 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.359242916 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.359256983 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.415157080 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.415183067 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.415199041 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.415213108 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.415235043 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.415266991 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.415312052 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.472686052 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.472740889 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.472778082 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.472781897 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.472805023 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.472826004 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.472830057 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.472877026 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.530797005 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.530850887 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.530888081 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.530894041 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.530919075 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.530936003 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.530936003 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.530991077 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.587069035 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.587124109 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.587146044 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.587162018 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.587181091 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.587199926 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.587213039 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.587251902 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.643331051 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.643383026 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.643419981 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.643428087 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.643456936 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.643456936 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.643462896 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.643508911 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.700686932 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.700737953 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.700762987 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.700798988 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.701176882 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.701217890 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.701248884 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.701272011 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.756937981 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.756985903 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.757034063 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.757061958 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.757299900 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.757343054 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.757364988 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.757406950 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.813076019 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.813128948 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.813170910 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.813215971 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.813303947 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.813344002 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.813363075 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.813380003 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.813390970 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.813460112 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.869337082 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.869414091 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.869424105 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.869455099 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.869471073 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.869491100 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.869508028 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.869529963 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.869548082 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.869585991 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.925534010 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.925585032 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.925622940 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.925642967 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.925661087 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.925663948 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.925669909 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.925697088 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.925709963 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.925744057 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.981868982 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.981895924 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.981911898 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.981926918 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.981939077 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:07.981947899 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.981971979 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:07.982023954 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:08.040199041 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:08.040240049 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:08.040256023 CET	443	49791	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:08.040292978 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:08.040323973 CET	49791	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:08.467257977 CET	49828	443	192.168.2.3	52.217.98.3
Jan 30, 2021 12:51:08.467426062 CET	49829	443	192.168.2.3	52.217.98.3
Jan 30, 2021 12:51:08.987698078 CET	80	49817	178.79.242.181	192.168.2.3
Jan 30, 2021 12:51:08.988972902 CET	49817	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:51:09.212579966 CET	49830	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:09.259082079 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.266773939 CET	49830	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:09.283423901 CET	49830	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:09.328437090 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.328573942 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.328699112 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.328742981 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.331199884 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.335479021 CET	49830	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:09.335531950 CET	49830	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:09.342598915 CET	49830	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:09.386281967 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.386502028 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.386615992 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.388290882 CET	49830	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:09.392039061 CET	49830	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:09.392069101 CET	49830	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:09.392142057 CET	49830	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:09.435813904 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.435951948 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.436048985 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.436074972 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.436403036 CET	443	49830	99.86.154.93	192.168.2.3
Jan 30, 2021 12:51:09.437870026 CET	49830	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:51:09.468940973 CET	49828	443	192.168.2.3	52.217.98.3
Jan 30, 2021 12:51:09.469031096 CET	49829	443	192.168.2.3	52.217.98.3
Jan 30, 2021 12:51:10.153237104 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.203246117 CET	49832	443	192.168.2.3	185.86.137.113
Jan 30, 2021 12:51:10.253242970 CET	443	49832	185.86.137.113	192.168.2.3
Jan 30, 2021 12:51:10.259337902 CET	49832	443	192.168.2.3	185.86.137.113
Jan 30, 2021 12:51:10.277905941 CET	49832	443	192.168.2.3	185.86.137.113
Jan 30, 2021 12:51:10.279412031 CET	443	49831	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:10.281115055 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.281421900 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.328088999 CET	443	49832	185.86.137.113	192.168.2.3
Jan 30, 2021 12:51:10.328140974 CET	443	49832	185.86.137.113	192.168.2.3
Jan 30, 2021 12:51:10.331393003 CET	49832	443	192.168.2.3	185.86.137.113
Jan 30, 2021 12:51:10.348947048 CET	49832	443	192.168.2.3	185.86.137.113
Jan 30, 2021 12:51:10.399023056 CET	443	49832	185.86.137.113	192.168.2.3
Jan 30, 2021 12:51:10.402558088 CET	49832	443	192.168.2.3	185.86.137.113
Jan 30, 2021 12:51:10.406502008 CET	49832	443	192.168.2.3	185.86.137.113
Jan 30, 2021 12:51:10.406552076 CET	49832	443	192.168.2.3	185.86.137.113
Jan 30, 2021 12:51:10.407460928 CET	443	49831	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:10.407516956 CET	443	49831	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:10.407561064 CET	443	49831	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:10.407598972 CET	443	49831	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:10.407625914 CET	443	49831	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:10.408823967 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.408884048 CET	443	49831	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:10.419193029 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.423343897 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.458211899 CET	443	49832	185.86.137.113	192.168.2.3
Jan 30, 2021 12:51:10.458962917 CET	443	49832	185.86.137.113	192.168.2.3
Jan 30, 2021 12:51:10.469058037 CET	49832	443	192.168.2.3	185.86.137.113
Jan 30, 2021 12:51:10.479187965 CET	49832	443	192.168.2.3	185.86.137.113
Jan 30, 2021 12:51:10.479262114 CET	49832	443	192.168.2.3	185.86.137.113
Jan 30, 2021 12:51:10.529421091 CET	443	49832	185.86.137.113	192.168.2.3
Jan 30, 2021 12:51:10.533359051 CET	443	49832	185.86.137.113	192.168.2.3
Jan 30, 2021 12:51:10.545135021 CET	49832	443	192.168.2.3	185.86.137.113
Jan 30, 2021 12:51:10.549705982 CET	443	49831	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:10.560280085 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.594451904 CET	49833	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.596883059 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.722071886 CET	443	49833	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:10.725106001 CET	443	49831	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:10.730212927 CET	49833	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.730257988 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.760296106 CET	49833	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.760508060 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.811417103 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.864952087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865020037 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865077019 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865132093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865190983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865255117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865318060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865374088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865463972 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865525007 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865581036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865623951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865669966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865705967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865745068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865792036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865838051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865879059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865914106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865951061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.865988016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866024017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866059065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866096973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866142035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866183043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866218090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866255045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866292000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866341114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866384029 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866420984 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866466999 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866507053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866544008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866595984 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866636038 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866671085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866708040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866743088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866789103 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866832018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866868019 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866904020 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866945982 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.866985083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.867022038 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.867057085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.867104053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.867145061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.868091106 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.869995117 CET	49834	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:10.875235081 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.876169920 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.876194954 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.876228094 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.876282930 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.886684895 CET	443	49833	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:10.886724949 CET	443	49833	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:10.887612104 CET	443	49831	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:10.906193972 CET	49833	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.906205893 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.922727108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.922785044 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.922833920 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.922871113 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.922908068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.922945023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.922980070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.924370050 CET	80	49834	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:10.926486969 CET	49834	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:10.926487923 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.929878950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.929944992 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.929999113 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930047989 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930085897 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930121899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930157900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930193901 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930257082 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930316925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930376053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930445910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930445910 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.930506945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930562973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930619955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930665970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930713892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930773020 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930830002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930885077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930926085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930962086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.930999041 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931035995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931071043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931108952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931144953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931190968 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931231976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931267977 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931304932 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931344032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931377888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931415081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931452036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931497097 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931538105 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931574106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931611061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931647062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931682110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931719065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931755066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931802034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931843042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931879044 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931915998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931952953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.931988955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.932024956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.932061911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.932107925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.932149887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.932197094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.932245016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.933643103 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.934953928 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.935003042 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.935009956 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.935014963 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:10.962724924 CET	49834	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:10.970741987 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.974025965 CET	49833	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.974836111 CET	49833	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:10.979448080 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.979504108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.979541063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.979587078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.979629040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.979665041 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.979701996 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.979739904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.979774952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.985177040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.985220909 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.985248089 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.985284090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.985325098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.985359907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.985443115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.985481977 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.986812115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.986851931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.986888885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.986934900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.986975908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.987013102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.987050056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.987086058 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.987121105 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.987159014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.987195015 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.987240076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.987936974 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.987998962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988042116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988095999 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988153934 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988209963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988270044 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988312960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988351107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988396883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988455057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988509893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988553047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988606930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988662958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988723040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988780975 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988847017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988907099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.988962889 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989015102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989062071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989098072 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989135027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989170074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989214897 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989254951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989300013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989346027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989404917 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989449024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989485979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989523888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989573956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989609003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989646912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989682913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989717960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989756107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989793062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989840031 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989881039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989916086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989953995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.989990950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.990025997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.990062952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:10.999463081 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.000098944 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.000123024 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.000144958 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.000194073 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.000205040 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.000217915 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.000268936 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.015961885 CET	80	49834	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:11.016330004 CET	80	49834	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:11.016381979 CET	80	49834	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:11.016429901 CET	80	49834	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:11.016472101 CET	80	49834	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:11.016509056 CET	80	49834	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:11.016546965 CET	80	49834	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:11.016577005 CET	80	49834	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:11.016601086 CET	80	49834	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:11.016808033 CET	49834	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:11.016841888 CET	49834	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:11.052617073 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.052666903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.052701950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.052747965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.052789927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.052825928 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.052861929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.052917004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.052973032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053026915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053077936 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053143024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053201914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053257942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053314924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053374052 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053479910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053544998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053603888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053659916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053718090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053776979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053833961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053891897 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.053950071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054013014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054056883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054092884 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054128885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054166079 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054200888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054251909 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054290056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054337978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054378986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054416895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054455042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054490089 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054526091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054563046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054600000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054645061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054686069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054721117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054758072 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054794073 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054828882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054866076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054902077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054948092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.054989100 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055025101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055062056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055098057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055133104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055169106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055203915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055249929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055305004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055345058 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055382013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055418968 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055453062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055490017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055526018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055571079 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055610895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055646896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055684090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055718899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055756092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055793047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055829048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055875063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055915117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055949926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.055986881 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056022882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056057930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056094885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056129932 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056175947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056216955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056252003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056288958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056325912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056360960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056396961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056432962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056478024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056518078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.056555033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.091726065 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.091785908 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.091793060 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.091799021 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.091804981 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.091824055 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.091852903 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.091873884 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.091917992 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.091953993 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.098537922 CET	443	49831	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:11.100749969 CET	443	49833	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:11.102730989 CET	443	49833	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:11.104873896 CET	49833	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:11.104932070 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:11.128745079 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.128808022 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.144731998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.144804001 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.144862890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.144922018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.144983053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145029068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145088911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145148993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145207882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145272970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145332098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145423889 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145518064 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145582914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145633936 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145692110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145746946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145806074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145870924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145929098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.145987034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146035910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146073103 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146109104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146145105 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146181107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146228075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146269083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146305084 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146344900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146382093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146416903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146454096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146488905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146534920 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146575928 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146610975 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146647930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146683931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146719933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146756887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146792889 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146837950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146878958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146914005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146950006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.146986961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147022009 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147058964 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147094965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147145033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147191048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147227049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147264957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147300959 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147336960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147372961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147408962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147454977 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147495985 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147531033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147591114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147631884 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147667885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147706032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147742033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147778034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147815943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147852898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147900105 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147939920 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.147975922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148014069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148050070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148086071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148123980 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148160934 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148207903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148250103 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148284912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148323059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148360968 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148396969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148435116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148472071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148519039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148560047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148597002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148633957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.148689032 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.149049044 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.149076939 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.149125099 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.149137020 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.149143934 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.149180889 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.149199009 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.149224997 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.149250031 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.181927919 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182002068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182040930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182046890 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.182079077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182116032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182162046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182178020 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.182255983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182296038 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182327032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182356119 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182398081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182467937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182512999 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.182523012 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182562113 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182564020 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.182585001 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.182635069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182674885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182712078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182749033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.182785034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.183140039 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.201782942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.201853037 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.201919079 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.201978922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202034950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202092886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202153921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202212095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202267885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202325106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202390909 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202450991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202507019 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202564955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202622890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202677965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202738047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202794075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202858925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202918053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.202974081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203036070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203095913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203151941 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203208923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203254938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203300953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203344107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203380108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203417063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203454018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203489065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203525066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203561068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203607082 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203648090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203684092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203722954 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203758955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203795910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203833103 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203867912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203913927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203954935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.203990936 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204027891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204063892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204098940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204135895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204170942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204230070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204271078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204308033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204345942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204381943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204416990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204454899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204492092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204538107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204579115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204613924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204651117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204688072 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204721928 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204758883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204794884 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204839945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204880953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204916954 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204955101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.204991102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205028057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205064058 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205101013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205147028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205188036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205223083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205259085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205296040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205329895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205369949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205466032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205506086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205553055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205594063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205630064 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205666065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205703020 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205738068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205775023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205811024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205857038 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205898046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205950022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.205990076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206027031 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206063986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206100941 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206136942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206182957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206223011 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206258059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206295013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206331015 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206367970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206404924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206439972 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206485987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.206526995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.207998037 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.208059072 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.208095074 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.208137035 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.209271908 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.209299088 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.209327936 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.209376097 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.209388018 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.209400892 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.209459066 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.209564924 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.235965967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236035109 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236092091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236149073 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236207962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236273050 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236331940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236382008 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.236392021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236450911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236473083 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.236509085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236566067 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236623049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236680031 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236718893 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.236746073 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236754894 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.236805916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.236996889 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.237045050 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.237097025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.237236023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.237299919 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.237358093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.237484932 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.237543106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.237689972 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.237751961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.237809896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.237867117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.237925053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.237983942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.238048077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.238090038 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.239168882 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.239476919 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.261069059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.261123896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.261162996 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.261203051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.276768923 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.306539059 CET	49834	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:11.307647943 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.362592936 CET	80	49834	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:11.362999916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363040924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363087893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363130093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363167048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363204002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363240957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363276005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363313913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363353014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363399029 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363440037 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363476038 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363514900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363552094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363589048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363626003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363631010 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.363662958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363677025 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.363711119 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363753080 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363789082 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363826990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363863945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363899946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363917112 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.363939047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.363976955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364022970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364029884 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.364042997 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.364064932 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364100933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364130020 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.364139080 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364177942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364212990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364252090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364288092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364335060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364377022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364413023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364438057 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.364449024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364486933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364521027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364557981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364594936 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364615917 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.364641905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364680052 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.364682913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364720106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364756107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364789963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364825010 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364861965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364897013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364943027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.364984035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365019083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365056992 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365092039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365128040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365164995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365201950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365247965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365288019 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365324020 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365361929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365427971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365458965 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.365466118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365504026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365541935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365577936 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365586042 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.365616083 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.365624905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365672112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365691900 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.365708113 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365746021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365782022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365818024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365854025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365883112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365911007 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365947008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.365993023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366034031 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366069078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366106987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366142035 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.366144896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366180897 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366219044 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366255045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366301060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366341114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366349936 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.366379023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366415977 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366451979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366487026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366523981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366559982 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366605043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366638899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366673946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366712093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.366736889 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.366760015 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.419960022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420016050 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420054913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420093060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420130014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420178890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420219898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420257092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420294046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420331955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420368910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420407057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420444012 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420490980 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420531988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420567989 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420604944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420644045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420680046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420717001 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420753002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420798063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420840025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420876026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420913935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420949936 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.420985937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421021938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421060085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421107054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421148062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421185017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421221972 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421257973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421294928 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421334028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421380043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421458960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421499014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421535969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421571970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421607971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421644926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421689987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421730042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421766043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421811104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421848059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421881914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421905041 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.421919107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.421957016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422003984 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422044992 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422080994 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422118902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422154903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422188997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422225952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422261953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422307014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422348022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422405958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422452927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422493935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422529936 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422565937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422602892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422646046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422684908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422722101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422766924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422808886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422844887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422882080 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422919035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422954082 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.422991037 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423027039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423073053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423114061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423150063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423187017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423223019 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423258066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423295021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423331976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423379898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423420906 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423456907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423494101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423531055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.423789024 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.426800013 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.429910898 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.430124998 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.430176973 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.430222034 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.430296898 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.430321932 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.430335999 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.479875088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.479943991 CET	49828	443	192.168.2.3	52.217.98.3
Jan 30, 2021 12:51:11.480030060 CET	49829	443	192.168.2.3	52.217.98.3
Jan 30, 2021 12:51:11.482727051 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.482853889 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.483258009 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.483306885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.483349085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.483387947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.483424902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.483462095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.495848894 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.501147985 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.537509918 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.537564993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.537601948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.537651062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.537694931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.537731886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.537770033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.537807941 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.537842989 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.537879944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.537916899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.537962914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538003922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538039923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538077116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538115025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538151026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538187027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538223028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538269997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538311958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538348913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538388968 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538425922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538461924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538497925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538535118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538580894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538621902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538657904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538695097 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538731098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538765907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538804054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538840055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.538886070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.550499916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.551950932 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.553153038 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.555493116 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.555721998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.557383060 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.557476044 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.557501078 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.607115030 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.607652903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.609159946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.611948967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.611990929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.612026930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.612062931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.612096071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.612143993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.617151976 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.617208958 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.617216110 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.617221117 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.617225885 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.617229939 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.672064066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.672416925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.672467947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.672524929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.672579050 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.672622919 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.672677994 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.672723055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.672780991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.672828913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.705168962 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.705224991 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.705230951 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.705235958 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.705240011 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.705245018 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.705249071 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.758254051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.758280039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.758291006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.758311987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.758331060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.758349895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.758369923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.758389950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.758409023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.758428097 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.758445978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.758460999 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.763251066 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.763286114 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.763288975 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.763292074 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.763293982 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.765502930 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.765515089 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.765518904 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.765522003 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:11.818751097 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.818803072 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.818840027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.818873882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.818908930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.820220947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.820256948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.820300102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:11.844255924 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:15.904968977 CET	49835	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:15.905765057 CET	49836	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:15.907773018 CET	49766	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:15.907797098 CET	49765	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:15.908252001 CET	49837	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:15.908303976 CET	49838	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:15.962811947 CET	80	49765	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:15.962879896 CET	443	49837	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:15.963490009 CET	80	49766	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:15.963515043 CET	80	49766	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:15.966619015 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:15.978791952 CET	49766	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:15.978840113 CET	49838	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:15.978842974 CET	49837	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:15.987483025 CET	49837	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:15.987524986 CET	49838	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:16.033727884 CET	443	49837	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.034939051 CET	443	49836	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.035003901 CET	443	49835	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.037125111 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.037444115 CET	49836	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.037503958 CET	49835	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.042335987 CET	443	49837	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.042355061 CET	49836	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.042598963 CET	49835	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.044176102 CET	443	49837	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.044224024 CET	443	49837	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.044261932 CET	443	49837	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.044286013 CET	443	49837	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.044322968 CET	443	49837	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.045938969 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.047842979 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.047966003 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.048006058 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.048031092 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.048057079 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.048149109 CET	49837	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:16.048651934 CET	49838	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:16.053760052 CET	49838	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:16.053927898 CET	49838	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:16.054374933 CET	49838	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:16.055620909 CET	49837	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:16.055757046 CET	49837	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:16.107793093 CET	443	49837	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.107829094 CET	443	49837	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.108165979 CET	443	49837	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.108196020 CET	443	49837	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.109507084 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.109667063 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.109703064 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.109738111 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.110048056 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.111804008 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.111836910 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.111860991 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.117718935 CET	49837	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:16.117844105 CET	49838	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:16.117918968 CET	49838	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:16.165844917 CET	49837	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:16.167457104 CET	49838	443	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:16.168157101 CET	443	49836	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.168342113 CET	443	49836	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.168381929 CET	443	49836	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.168416023 CET	443	49836	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.168452978 CET	443	49836	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.169245958 CET	443	49835	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.169482946 CET	443	49836	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.169527054 CET	443	49835	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.169560909 CET	443	49835	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.169606924 CET	443	49835	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.169637918 CET	443	49835	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.170752048 CET	443	49835	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.176778078 CET	49836	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.176817894 CET	49836	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.176831007 CET	49835	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.183942080 CET	49836	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.184106112 CET	49836	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.184654951 CET	49835	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.184808969 CET	49835	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.218182087 CET	443	49837	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.223246098 CET	443	49838	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.311487913 CET	443	49836	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.312539101 CET	443	49836	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.314172029 CET	443	49835	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.314201117 CET	443	49836	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.314228058 CET	443	49835	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:16.338948965 CET	49836	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.338953018 CET	49835	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.338989973 CET	49836	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.339001894 CET	49835	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:16.819530964 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:16.952141047 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.145889997 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.201584101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.334314108 CET	49839	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:19.337820053 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.390878916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.390930891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.391509056 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.444629908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.444695950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.444737911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.444868088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.444925070 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.444972992 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.460591078 CET	80	49839	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:19.460697889 CET	49839	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:19.498054981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.498107910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.498143911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.498183012 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.498219013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.498234034 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.498266935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.498267889 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.498308897 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.498364925 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.540098906 CET	49839	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:19.551306009 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.551352024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.551398993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.551440954 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.551479101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.551492929 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.551516056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.551532984 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.551554918 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.551592112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.551606894 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.551629066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.551664114 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.551666021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.551717043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.551759005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.551760912 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.552133083 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.604763031 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.604823112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.604860067 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.604907990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.604950905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605031013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605074883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605112076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605149984 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605185986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605221987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605258942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605294943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605340958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605381966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605459929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605495930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605541945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605582952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605618954 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605655909 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605693102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605729103 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.605765104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.622203112 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.625113010 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.625610113 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.666554928 CET	80	49839	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:19.667771101 CET	80	49839	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:19.667802095 CET	80	49839	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:19.675271034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.675323009 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.675359964 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.675405979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.675446987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.675482988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.675519943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.675556898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.675591946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.675628901 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.675664902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.675712109 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.675753117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678231001 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678282976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678322077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678359032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678395033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678431988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678467989 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678515911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678558111 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678595066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678632021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678668976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678705931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678744078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678780079 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678826094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.678868055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.708416939 CET	49839	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:19.708564043 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.708610058 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.708619118 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.708703995 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.764688969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.764744997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.764784098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.764821053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.764858007 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.764904022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.764945984 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.764981985 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765018940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765055895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765093088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765130997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765166998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765213966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765254974 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765290976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765327930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765367985 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765439034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765474081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765511036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765547991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765594006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765634060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765670061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765707016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765743017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765779018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765815973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765853882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765899897 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765939951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.765975952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.766014099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.766057014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.766096115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.766132116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.766169071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.771444082 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.774426937 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.774780989 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.776228905 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.776648045 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.824806929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.824862957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.824901104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.825011969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.827553034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.827594995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.827632904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.827678919 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.827719927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.827756882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.827794075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.827830076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.827864885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.827900887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.827939034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.827985048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.828026056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.828062057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.828099966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.828136921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.828171968 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.828207970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.828243971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.828289986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.828330040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.828366995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.829231977 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.829284906 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.829323053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.829369068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.829444885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.829485893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.829524040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.829560995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.829596996 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.829643965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.829685926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.829721928 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.830001116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.830053091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.830096006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.830136061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.830173969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.830209017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.830245972 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.830281973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.830327988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.830368996 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.831403017 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.831464052 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.831474066 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.831480980 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.831551075 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.884496927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.884550095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.884586096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.884624004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.884660006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.884706974 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.884748936 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.884784937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.884821892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.884859085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.884893894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.884932041 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.884968042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885014057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885055065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885092974 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885130882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885168076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885202885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885240078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885276079 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885322094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885363102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885435104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885472059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885509968 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885546923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885581970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885618925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885656118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885701895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885742903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885780096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885817051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885853052 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885889053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885925055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.885961056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886007071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886048079 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886086941 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886123896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886159897 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886195898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886233091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886270046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886316061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886357069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886393070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886430979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886466026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886501074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886538982 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886575937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886621952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886663914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886698961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.886735916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.893065929 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.896086931 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.896120071 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.896136045 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.896190882 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.900743008 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.900800943 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.948057890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.948115110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.948153973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.948191881 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.948229074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.948275089 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.948317051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.948353052 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951316118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951369047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951411009 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951447964 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951484919 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951523066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951560020 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951611042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951652050 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951689005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951726913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951765060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951801062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951838017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951874971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951921940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951962948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.951998949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:19.971226931 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.971280098 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.971287012 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:19.971355915 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:20.528310061 CET	443	49832	185.86.137.113	192.168.2.3
Jan 30, 2021 12:51:20.528353930 CET	443	49832	185.86.137.113	192.168.2.3
Jan 30, 2021 12:51:20.530256987 CET	49832	443	192.168.2.3	185.86.137.113
Jan 30, 2021 12:51:22.402120113 CET	49839	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:22.529069901 CET	80	49839	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:25.024724007 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:25.231699944 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.170676947 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.225495100 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.225547075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.225583076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.225634098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.225676060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.225712061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.225737095 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.225752115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.225783110 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.225790024 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.225791931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.225828886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.225858927 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.225867033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.225903988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.225919962 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.225950956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.225991964 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226010084 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.226028919 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226066113 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226103067 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226131916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226161957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226191998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226227999 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226233006 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.226264000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226300955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226306915 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.226340055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226353884 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.226376057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226413012 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226449013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226470947 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.226490974 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.226495981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226536989 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226572990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226593018 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.226609945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226650000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226685047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226711035 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.226722002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226737976 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.226759911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226805925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226846933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226865053 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.226883888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226922035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226938963 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.226958990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.226977110 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.226994991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227031946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227049112 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.227070093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227116108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227157116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227173090 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.227193117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227231026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227253914 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.227262974 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227299929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227320910 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.227336884 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227355003 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.227374077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227420092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227463007 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227478981 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.227499962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227538109 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227551937 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.227575064 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227608919 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.227610111 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227650881 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227665901 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.227686882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227734089 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227775097 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227778912 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.227811098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227848053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227864981 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.227885008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227901936 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.227926016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.227982044 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.280850887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.280900002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.280947924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.280982018 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.280989885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281028986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281049967 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.281066895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281105042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281140089 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281155109 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.281177998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281213999 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281230927 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.281260014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281301975 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281316042 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.281338930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281352997 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.281378031 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281450987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281460047 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.281486988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281533003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281539917 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.281574965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281610966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281650066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281665087 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.281689882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281702995 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.281725883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281763077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281780958 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.281800985 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281847000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281888962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281907082 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.281924963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281964064 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.281974077 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282002926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282038927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282058001 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282077074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282102108 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282114029 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282160997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282201052 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282216072 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282239914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282277107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282294035 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282314062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282329082 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282351017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282387972 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282404900 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282426119 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282471895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282512903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282527924 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282548904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282587051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282604933 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282624006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282639980 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282661915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282700062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282736063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282749891 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282782078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282823086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282835960 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282859087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282876968 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282898903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282936096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.282952070 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.282970905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283011913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283025980 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.283049107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283094883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283135891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283149958 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.283171892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283210039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283226013 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.283246994 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283263922 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.283282995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283322096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283339024 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.283359051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283405066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283415079 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.283447027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283482075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283519030 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283535957 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.283555984 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283591986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283612013 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.283631086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283639908 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.283668995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283715963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283725023 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.283757925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283795118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283814907 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.283833981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283870935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283890009 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.283906937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283943892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283979893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.283987999 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.284027100 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.284068108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.284081936 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.284105062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.284126043 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.284142971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.284179926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.284214020 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.284236908 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.284261942 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.337179899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.337245941 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.337305069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.337358952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.337371111 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.337450027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.337506056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.337523937 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.337559938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.337562084 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.337616920 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.337686062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.337728024 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.337745905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.337790012 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.337807894 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.337848902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.337908983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.337941885 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.337965012 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.338021994 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.338068008 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.338079929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.338145018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.338203907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.338205099 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.338259935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.338291883 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.339754105 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.339802027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.339827061 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.339840889 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.339879036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.339915037 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.339932919 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.339962006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.339971066 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.340003014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340042114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340069056 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.340080023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340116978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340152979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340168953 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.340189934 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340197086 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.340228081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340275049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340293884 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.340316057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340353966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340368032 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.340392113 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340428114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340464115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340476990 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.340502024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340523005 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.340538025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340584993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340630054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340666056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340703011 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340739965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340744019 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.340758085 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.340778112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340816021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340831041 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.340852022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340899944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340940952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340970993 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.340979099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.340995073 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.341017962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341056108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341073990 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.341092110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341129065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341144085 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.341166973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341212988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341253996 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341269970 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.341290951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341327906 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341341972 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.341365099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341433048 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.341434002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341470957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341507912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341521978 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.341543913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341589928 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341598034 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.341630936 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341670036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341686010 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.341707945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341744900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341759920 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.341782093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341819048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341831923 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.341856003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341902971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341907978 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.341943979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341979980 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.341996908 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.342017889 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342055082 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342072010 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.342091084 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342129946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342145920 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.342165947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342191935 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.342215061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342256069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342271090 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.342360973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342401028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342437983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342454910 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.342475891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342513084 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342530012 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.342550039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342587948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342605114 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.342636108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342678070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342689037 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.342714071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342752934 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342766047 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.342791080 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342828035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342840910 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.342864990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342901945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342916012 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.342947960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.342950106 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.342989922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.343025923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:26.343039989 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.544106960 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:26.553467035 CET	49840	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:26.679157019 CET	80	49840	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:26.680737972 CET	49840	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:27.607261896 CET	49840	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:27.612979889 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.666013002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666068077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666105986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666145086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666181087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666229963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666230917 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.666274071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666311979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666328907 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.666352987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666371107 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.666390896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666428089 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666448116 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.666465044 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666502953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666549921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666590929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666605949 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.666627884 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666665077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666702032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666719913 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.666738987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666778088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666793108 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.666815042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666848898 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.666862011 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666904926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666941881 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.666980028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667004108 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.667017937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667053938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667090893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667129040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667151928 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.667174101 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.667176008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667218924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667254925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667284966 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.667292118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667306900 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.667330027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667366028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667382002 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.667402983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667439938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667485952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667495012 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.667527914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667567015 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667598009 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667627096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667654991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667692900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667716980 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.667738914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667778969 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.667782068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667819023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667844057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667879105 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667900085 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.667915106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667953014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.667989016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668035984 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668045998 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.668077946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668112993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668149948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668170929 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.668188095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668226004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668241978 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.668291092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668333054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668369055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668390036 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.668405056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668442965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668457031 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.668478966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668515921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668554068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668574095 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.668629885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668682098 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.668706894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668750048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668773890 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.668787956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668824911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668860912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668879032 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.668896914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668934107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668971062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.668989897 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.669018030 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669060946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669075966 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.669100046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669137001 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669173956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669200897 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.669209957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669246912 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.669248104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669285059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669331074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669341087 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.669373035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669451952 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.669471979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669508934 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669545889 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669559002 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.669583082 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669619083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669656038 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669677019 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.669692993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669740915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669747114 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.669783115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669820070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669850111 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669878960 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.669887066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669923067 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669926882 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.669960022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.669980049 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.669996977 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.670042992 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.670085907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.670120955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.670130968 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.670156956 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.670159101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.670197964 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.670294046 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725056887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725107908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725147963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725188017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725200891 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725225925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725234032 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725249052 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725264072 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725301981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725326061 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725337982 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725363970 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725405931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725406885 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725454092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725471020 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725496054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725533009 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725569963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725574017 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725598097 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725615025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725617886 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725668907 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725709915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725748062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725785017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725821018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725852966 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725867987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725868940 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.725909948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725939035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.725969076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726005077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726042032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726047039 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726073027 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726079941 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726109028 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726116896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726154089 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726171970 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726192951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726224899 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726258039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726299047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726334095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726358891 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726380110 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726387978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726425886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726463079 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726496935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726517916 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726533890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726556063 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726573944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726578951 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726622105 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726663113 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726697922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726716995 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726736069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726753950 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726777077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726813078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726847887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726871967 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726883888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726902008 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.726931095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.726972103 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.727008104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.727026939 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.727046013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.727077007 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.727083921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.727107048 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.727121115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.727175951 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.732867002 CET	80	49840	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:27.733886003 CET	80	49840	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:27.733911991 CET	80	49840	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:27.734571934 CET	49840	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:27.782963037 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783065081 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.783066988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783199072 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.783391953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783433914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783472061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783472061 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.783487082 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.783531904 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.783605099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783653021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783694983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783710957 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.783731937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783771992 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783808947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783823967 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.783844948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783881903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783917904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.783934116 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.783977985 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784017086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784032106 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.784054041 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784068108 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.784111023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784111977 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.784164906 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784205914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784208059 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.784243107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784259081 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.784281015 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784290075 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.784333944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784369946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784406900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784424067 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.784442902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784450054 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.784490108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784531116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784567118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.784667015 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.787555933 CET	49840	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:27.832140923 CET	49841	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:27.840414047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840457916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840496063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840507984 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.840534925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840542078 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.840572119 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840599060 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.840610027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840630054 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.840647936 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840667963 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.840694904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840744972 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.840750933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840769053 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.840794086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840832949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840857983 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.840873003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840910912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840949059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.840970039 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.840986967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841036081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841062069 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841078997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841116905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841152906 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841190100 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841197014 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841224909 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841226101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841263056 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841264963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841279984 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841301918 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841325998 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841348886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841365099 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841415882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841454029 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841511011 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841542006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841571093 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841578960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841618061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841620922 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841636896 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841655970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841691017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841726065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841749907 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841764927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841770887 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841811895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841852903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841887951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841916084 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841926098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841928959 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.841963053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.841999054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842050076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842052937 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.842087984 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842122078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842168093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842176914 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.842210054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842246056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842283010 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842317104 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.842319965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842356920 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842371941 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.842395067 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842432022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842453003 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.842478037 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842519045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842535019 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.842556000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842593908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842631102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.842648983 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.843231916 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.844523907 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.856755018 CET	49842	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:27.887932062 CET	80	49841	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:27.888876915 CET	49841	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:27.898102045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898154974 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898201942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898228884 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.898243904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898282051 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.898286104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898313046 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.898324013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898361921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898375988 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.898400068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898413897 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.898437977 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898452044 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.898477077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898525000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898526907 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.898566961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898603916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898629904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898662090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898664951 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.898688078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898713112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898736000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898770094 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.898787022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898808002 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.898817062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898842096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898866892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898890972 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898912907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898936987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898960114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.898993969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.899022102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.899044991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.899070024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.899092913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.899115086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.899137974 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.899161100 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.899194956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.899224043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.900145054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.900424957 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.915663958 CET	80	49840	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:27.930721045 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.954663038 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.954716921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.954754114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.954793930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.954792976 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.954833031 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.954869032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.954905033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.954945087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.954946995 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.954993010 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.954999924 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.955035925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.955071926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.955090046 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.955110073 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.955148935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.955184937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.955207109 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.955240965 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.955744982 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.955785990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:27.955849886 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:27.984869957 CET	80	49842	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:27.984968901 CET	49842	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:28.010473013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.010520935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.010559082 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.010595083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.010593891 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.010632038 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.010670900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.010708094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.010710955 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.010765076 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.010766029 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.010807991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.010843039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.010875940 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.010889053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.010931969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.010957003 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.010967970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.010982990 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.011008978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011045933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011063099 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.011080980 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011118889 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011157036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011173010 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.011204004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011209965 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.011245966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011281013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011333942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011347055 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.011373043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011409044 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011441946 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.011445045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011466026 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.011483908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011521101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011537075 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.011567116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011607885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.011800051 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.065653086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.065707922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.065747023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.065752983 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.065787077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.065828085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.065846920 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.065865993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.065881014 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.065913916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.065954924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.065969944 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.065990925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066029072 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066066027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066102028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066123962 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.066138983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066178083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066224098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066263914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066294909 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.066301107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066339016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066354036 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.066376925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066412926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066448927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066452980 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.066487074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066500902 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.066534996 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066576004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066586018 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.066613913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066651106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066687107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066703081 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.066723108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066760063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066776037 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.066800117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066847086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066852093 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.066888094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066920996 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.066925049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066962957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.066977024 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.067001104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067037106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067074060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067110062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067123890 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.067158937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067200899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067236900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067262888 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.067274094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067286968 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.067312956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067348003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067384005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067399979 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.067421913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067430019 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.067468882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067509890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067545891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067565918 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.067584038 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067601919 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.067621946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067656994 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067693949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067723036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.067842007 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.120623112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.120665073 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.120693922 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.120702982 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.120733023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.120773077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.120826006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.120899916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.120903015 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.120944977 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.120981932 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.120995998 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.121017933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121028900 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.121054888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121130943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121177912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121218920 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121229887 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.121254921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121293068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121330023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121357918 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.121365070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121412039 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.121434927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121474028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121484995 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.121510983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121556997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121597052 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121607065 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.121668100 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121706963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121725082 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.121753931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121778965 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.121797085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121834040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121870995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121891022 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.121908903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121922970 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.121943951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.121980906 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122018099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122051954 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.122064114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122076988 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.122107029 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122143984 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122180939 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122193098 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.122217894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122236967 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.122255087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122292042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122343063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122365952 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.122379065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122396946 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.122426033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122466087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122502089 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122523069 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.122539997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122558117 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.122577906 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122612953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122627974 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.122648954 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122685909 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122697115 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.122764111 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122803926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122842073 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122879028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122900009 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.122924089 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.122966051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123001099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123013020 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.123038054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123049974 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.123075962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123111963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123126984 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.123150110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123187065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123231888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123274088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123286009 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.123311043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123311043 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.123349905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123388052 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123423100 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123444080 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.123473883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123512983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123548031 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123593092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123596907 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.123635054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123671055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123699903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123728991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123768091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123784065 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.123806953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123852015 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.123874903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123909950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123945951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.123981953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.124001980 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.124018908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.124054909 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.124092102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.124136925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.124141932 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.124178886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.124214888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.124252081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.124264956 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.124289036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.124325037 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.124336004 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.124370098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.124428988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.124466896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.124480963 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.174545050 CET	49842	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:28.180110931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180188894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180236101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180275917 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180303097 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.180313110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180351973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180389881 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180407047 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.180425882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180437088 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.180494070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180525064 CET	49841	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:28.180532932 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180546999 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.180572033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180608034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180645943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180660009 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.180682898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180731058 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180732012 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.180788040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180829048 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.180835962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180871010 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.180874109 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180912018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180924892 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.180948019 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.180974007 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.180985928 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181021929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181081057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181097984 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.181121111 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181127071 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.181158066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181204081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181205034 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.181246996 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181282997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181298018 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.181320906 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181359053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181417942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181453943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181459904 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.181472063 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.181514025 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.181520939 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181560040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181596041 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181607962 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.181631088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181642056 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.181669950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181737900 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.181737900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181783915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181822062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181859016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181874990 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.181895971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181942940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.181945086 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.181993008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.182029009 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.182029009 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.182068110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.182085037 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.182106018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.182142019 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.182178974 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.182214975 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.182218075 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.182239056 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.182288885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.182327986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.182347059 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.182364941 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.182394981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.182423115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.182461023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.182478905 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.182552099 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.238293886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238358021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238400936 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238399029 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.238440037 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238480091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238518000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238548040 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.238554001 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238593102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238630056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238650084 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.238677025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238687992 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.238720894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238758087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238780975 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.238797903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238837004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238873959 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238910913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238929033 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.238946915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.238993883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239034891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239070892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239108086 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.239109039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239147902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239182949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239221096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239259005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239264011 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.239305973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239351988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239387989 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239394903 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.239425898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239424944 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.239487886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239526033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239546061 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.239562035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239598989 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239602089 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.239635944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239681959 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239686012 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.239723921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239763021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239803076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239830971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239860058 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239897013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239923000 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.239933014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239970922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.239995003 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.240006924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240025043 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.240055084 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240096092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240113974 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.240133047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240159035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240187883 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.240195036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240231991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240268946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240304947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240324020 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.240351915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240392923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240428925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240448952 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.240466118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240503073 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240537882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240556002 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.240575075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240611076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240631104 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.240658045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240700006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240736008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240756035 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.240782976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240819931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240838051 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.240855932 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240892887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240910053 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.240928888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.240964890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241002083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241020918 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.241038084 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241085052 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241091967 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.241126060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241162062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241198063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241216898 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.241235018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241270065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241285086 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.241311073 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241348028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241368055 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.241425991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241473913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241514921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241530895 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.241543055 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.241550922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241590023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241626978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241643906 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.241662025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241683960 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.241698980 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241739035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241785049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241827965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241846085 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.241864920 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241892099 CET	80	49841	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:28.241928101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.241961002 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.241961956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242001057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242036104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242080927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242096901 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.242121935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242157936 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242187977 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.242194891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242232084 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242252111 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.242266893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242305040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242341042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242351055 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.242373943 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.242405891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242429972 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.242446899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242466927 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.242485046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242507935 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.242525101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242562056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242599964 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.242610931 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.242645979 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.242659092 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.295629978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.295684099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.295731068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.295773029 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.295778036 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.295814991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.295816898 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.295821905 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.295826912 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.295854092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.295876980 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.295892000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.295929909 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.295929909 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.295943975 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.295969963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296008110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296053886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296045065 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296071053 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296097994 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296135902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296135902 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296185017 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296194077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296199083 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296233892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296271086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296298027 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296308994 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296348095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296380043 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296384096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296403885 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296432018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296457052 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296473026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296504974 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296509981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296545029 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296549082 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296571016 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296587944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296610117 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296623945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296678066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296715021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296736002 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296753883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296770096 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296793938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296813011 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296834946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296881914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296922922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296952009 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296960115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.296998024 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.296998978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297035933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297050953 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.297066927 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.297074080 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297111988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297128916 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.297149897 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297179937 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.297198057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297223091 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.297239065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297241926 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.297276020 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297312975 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297349930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297374010 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.297411919 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.297414064 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297452927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297511101 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.297543049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297609091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297656059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297673941 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.297698021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297733068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297770977 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297795057 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.297810078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297846079 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297872066 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.297883034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297920942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.297966957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298007965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298031092 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298044920 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298074007 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298103094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298140049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298177004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298182011 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298213959 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298226118 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298252106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298274040 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298290014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298336029 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298376083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298408985 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298412085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298450947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298465967 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298489094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298508883 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298523903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298548937 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298563004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298599005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298624992 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298644066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298648119 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298686028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298722982 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298758984 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298779964 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298798084 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298818111 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298834085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298871040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298892975 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298907042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298921108 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.298954010 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.298995018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.299031019 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.299053907 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.299068928 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.299083948 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.299108982 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.299144030 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.299168110 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.299181938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.299184084 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.299201012 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.299221992 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.299245119 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.299268961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.299285889 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.299310923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.299325943 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.299365044 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.300309896 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.302634954 CET	80	49842	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:28.303565025 CET	80	49842	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:28.303596973 CET	80	49842	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:28.304039955 CET	49842	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:28.352325916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352374077 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352411032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352416039 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.352448940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352454901 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.352487087 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.352487087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352502108 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.352535963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352577925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352590084 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.352613926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352650881 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352664948 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.352688074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352724075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352761030 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352778912 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.352796078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352819920 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.352844954 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352886915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352900028 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.352922916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352961063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.352997065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353013992 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353033066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353070021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353085995 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353106976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353152990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353195906 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353208065 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353231907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353269100 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353283882 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353306055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353344917 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353358984 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353404999 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353409052 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353454113 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353455067 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353491068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353504896 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353538036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353559017 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353579998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353586912 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353615999 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353646040 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353653908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353662968 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353692055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353704929 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353751898 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353789091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353828907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353844881 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353864908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353883982 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.353903055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353929043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353951931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353975058 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.353987932 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.354000092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.354033947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.408818960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.408857107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.408891916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.408911943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.408927917 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.408943892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.408960104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.408984900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409009933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409133911 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.409215927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409243107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409266949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409291029 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409312963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409337997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409360886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409421921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409459114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409487009 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409509897 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409533978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409559011 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409580946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409605026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.409627914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.478018045 CET	49842	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:28.497634888 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.550575018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.603801012 CET	80	49842	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:28.638041973 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.691277981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.691339016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.691828012 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.730920076 CET	49843	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:28.744787931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.744842052 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.744879961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.744926929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.744951963 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.745749950 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.798273087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.798366070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.798407078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.798445940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.798450947 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.798481941 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.798505068 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.798640013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.798680067 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.798732996 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.851460934 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.851519108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.851557016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.851593971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.851618052 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.851640940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.851654053 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.851695061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.851728916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.851752996 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.851763964 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.851824999 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.851939917 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.851975918 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.852018118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.852055073 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.852089882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.852109909 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.859371901 CET	80	49843	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:28.859519958 CET	49843	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:28.905082941 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905129910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905217886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905225992 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.905262947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905299902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905339003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905360937 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.905375957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905436993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905483961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905503035 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.905527115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905558109 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.905564070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905601978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905638933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905694008 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.905719042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905759096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905793905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905822992 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905879974 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905908108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905946016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.905977964 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.905982018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.906029940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.906069994 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.961517096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.961565971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.961601973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.961648941 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.961683989 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.961765051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.961826086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.961865902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.961873055 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.961903095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.961927891 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.961941004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.961978912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.962013006 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.962033033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.962289095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.962340117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.962348938 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.962383032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.962421894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.962495089 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.962575912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.962779999 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.962852001 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.962924004 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.963148117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963222980 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963310003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963347912 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.963363886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963407040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963407993 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.963444948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963478088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963511944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963531971 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.963546991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963579893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963613033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963670969 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.963682890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963717937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963749886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963783026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963804960 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.963815928 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.963870049 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:28.963896990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:28.964915037 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.016866922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.016927004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.016968966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017005920 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017044067 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017081022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017081976 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.017132998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017168045 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.017172098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017211914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017249107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017285109 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.017301083 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.017307997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017345905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017378092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017446041 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.017450094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017539024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017582893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017621994 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017656088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017673969 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.017690897 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017726898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017745018 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.017760992 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017781973 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.017795086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017961025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.017997026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.018023014 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.018038988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.018043041 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.018075943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.018110037 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.018132925 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.018142939 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.018176079 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.018204927 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.018208981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.018244028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.018296003 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.018325090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.018841982 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019149065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019213915 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.019262075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019295931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019330025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019350052 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.019365072 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019407988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019423962 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.019486904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019526005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019558907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019566059 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.019601107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019619942 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.019639969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019673109 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019707918 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019741058 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019763947 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.019773960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019809961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019835949 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.019860983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019900084 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019941092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019956112 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.019979954 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.019987106 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.020013094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020047903 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020073891 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.020081043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020113945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020210028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020256042 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.020256996 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020292044 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020298004 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.020325899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020359993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020376921 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.020402908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020426035 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.020441055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020473957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020513058 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.020606995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020647049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020673990 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.020688057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020725965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020759106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020781994 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.020792961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020843983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.020972013 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.074012041 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074064970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074101925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074140072 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074177027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074217081 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.074223042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074255943 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.074265957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074304104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074328899 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.074341059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074356079 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.074378967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074414968 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074451923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074474096 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.074489117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074537039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074570894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074599981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074637890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074675083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074686050 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.074716091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074752092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074755907 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.074788094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074870110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074918985 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074928999 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.074960947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.074996948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075032949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075052977 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.075069904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075104952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075119972 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.075155973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075192928 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075212002 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.075229883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075283051 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.075387955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075428963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075467110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075521946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075539112 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.075563908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075599909 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075637102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075659037 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.075683117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.075736046 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.075928926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.076006889 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.076350927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.076421976 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.076976061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077023029 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077064037 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077099085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077100039 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.077136993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077172995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077209949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077230930 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.077249050 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077286959 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077312946 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.077332973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077374935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077435970 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.077481985 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077523947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077560902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077606916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077622890 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.077649117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077686071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077722073 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077758074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077763081 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.077775002 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.077794075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077857018 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.077869892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077917099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077955961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.077977896 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.077992916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.078031063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.078053951 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.078067064 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.078102112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.078138113 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.078165054 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.078176022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.078206062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.078356028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.078401089 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.078408957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.078468084 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.078493118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.078649044 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.078962088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.079000950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.079041004 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.079042912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.079063892 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.079277039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.079417944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.079479933 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.079765081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.079853058 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.079893112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.079933882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.079971075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.080007076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.080035925 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.080044985 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.080069065 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.080081940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.080128908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.080167055 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.080168962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.080207109 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.080285072 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.080321074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:29.080358028 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.231858969 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:29.237943888 CET	80	49841	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:29.278696060 CET	49841	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:29.331844091 CET	80	49841	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:29.331896067 CET	80	49841	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:29.331967115 CET	49841	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:29.385454893 CET	80	49841	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:29.385515928 CET	80	49841	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:29.385588884 CET	80	49841	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:29.385627031 CET	49841	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:29.438848019 CET	80	49841	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:29.438927889 CET	49841	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:30.431056976 CET	80	49761	98.143.146.7	192.168.2.3
Jan 30, 2021 12:51:30.447139978 CET	49761	80	192.168.2.3	98.143.146.7
Jan 30, 2021 12:51:33.059472084 CET	49843	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:33.188103914 CET	80	49843	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:33.189459085 CET	80	49843	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:33.189493895 CET	80	49843	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:33.204251051 CET	49843	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:33.898741007 CET	49843	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:34.029563904 CET	80	49843	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:34.087014914 CET	443	49816	54.208.194.17	192.168.2.3
Jan 30, 2021 12:51:34.092031956 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:34.284908056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:34.344100952 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.382271051 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.435700893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.435760021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.435810089 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.435837984 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.435858011 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.435906887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.435926914 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.435964108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436018944 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.436033010 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436083078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436132908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436139107 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.436182976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436232090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436235905 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.436280966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436328888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436333895 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.436378002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436435938 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.436463118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436522007 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436575890 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.436580896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436640978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436693907 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.436700106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436763048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436815977 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.436821938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436883926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.436934948 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.436975002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437033892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437091112 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.437094927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437184095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437236071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437258959 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.437285900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437335014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437359095 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.437372923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437436104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437489033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437549114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437575102 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.437597990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437645912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437650919 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.437695026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437742949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437746048 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.437791109 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437839985 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437840939 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.437889099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437936068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.437941074 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.437984943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438031912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438039064 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.438081026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438127995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438132048 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.438177109 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438219070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438231945 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.438270092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438317060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438322067 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.438366890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438414097 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438416958 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.438466072 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438514948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438514948 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.438564062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438612938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438616991 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.438662052 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438710928 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438711882 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.438759089 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438806057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438807964 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.438853979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438901901 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.438905954 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.438987970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439038992 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.439039946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439090014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439141035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439147949 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.439209938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439275980 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.439277887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439338923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439392090 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.439398050 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439461946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439515114 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.439521074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439580917 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439632893 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.439640999 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439702034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439755917 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.439786911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439837933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439886093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439887047 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.439934015 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439981937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.439984083 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.440030098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.440083027 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.440105915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.440164089 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.440216064 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.440222979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.440284967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.440342903 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.440345049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.440407038 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.440459013 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.440466881 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.440547943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.440598965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.440601110 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.440648079 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.440704107 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.440723896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.440797091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.440853119 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.477569103 CET	49844	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:35.493891954 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.493972063 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.493985891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494040966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494041920 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494091988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494102001 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494143009 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494144917 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494195938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494195938 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494268894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494328022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494355917 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494395018 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494395971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494451046 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494457006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494513988 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494518042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494574070 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494577885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494632006 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494637966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494693995 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494699955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494760990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494765043 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494813919 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494821072 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494875908 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494883060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494936943 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.494942904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.494997978 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495002985 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495058060 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495063066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495120049 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495122910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495178938 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495183945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495237112 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495243073 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495299101 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495301962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495374918 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495417118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495471001 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495471954 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495522976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495531082 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495572090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495574951 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495620966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495625973 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495671034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495676994 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495719910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495723963 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495769024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495773077 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495817900 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495817900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495874882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.495877981 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495927095 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.495946884 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496000051 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496001005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496054888 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496063948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496104956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496162891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496206045 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496222019 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496222973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496272087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496282101 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496320963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496323109 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496371031 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496373892 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496421099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496422052 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496471882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496471882 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496520042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496525049 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496593952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496634960 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496640921 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496654034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496714115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496712923 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496768951 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496773958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496829033 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496834040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496887922 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496893883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.496949911 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.496953964 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497006893 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497014046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497106075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497152090 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497162104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497164011 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497211933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497215986 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497261047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497267008 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497311115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497313976 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497360945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497365952 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497421026 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497433901 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497486115 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497488022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497536898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497540951 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497586012 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497587919 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497641087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497679949 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497690916 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497725964 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497778893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497783899 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497828960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497833014 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497878075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.497883081 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497936964 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.497962952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498016119 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498019934 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498065948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498070955 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498106003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498132944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498187065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498255014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498281956 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498302937 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498305082 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498354912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498359919 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498409986 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498411894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498475075 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498512983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498562098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498567104 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498613119 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498634100 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498662949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498680115 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498712063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498727083 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498761892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498774052 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498811960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498828888 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498862982 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498877048 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498912096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498928070 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.498961926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.498970032 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499011993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499022961 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499062061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499084949 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499111891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499125957 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499161959 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499171019 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499212027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499216080 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499260902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499264002 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499310017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499357939 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499362946 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499407053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499423981 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499433041 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499459982 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499479055 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499510050 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499528885 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499558926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499573946 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499609947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499624014 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499660015 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499669075 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499711037 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.499717951 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.499771118 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.508367062 CET	49841	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:35.552829027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.552911997 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.552932978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.552988052 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.552989006 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.553040981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553042889 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.553092003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553116083 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.553172112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553227901 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553251028 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.553261995 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.553284883 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.553289890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553339005 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.553349018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553410053 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.553467035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553544998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553669930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553685904 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.553725958 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.553744078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553800106 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.553813934 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553864002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553868055 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.553914070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553919077 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.553962946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.553966045 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.554013014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554017067 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.554061890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554068089 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.554111958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554112911 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.554161072 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554166079 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.554210901 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554214001 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.554260969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554263115 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.554310083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554316998 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.554359913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554363012 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.554402113 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554418087 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.554454088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554502010 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554549932 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554564953 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.554598093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554616928 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.554646969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.554652929 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.554702044 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.561553001 CET	80	49841	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:35.604125977 CET	80	49844	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:35.604305983 CET	49844	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:35.607696056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.607757092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.607765913 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.607810974 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.607820988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.607873917 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.607882023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.607942104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.607943058 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608001947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608006001 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608062029 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608062983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608123064 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608123064 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608181000 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608184099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608239889 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608244896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608304977 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608308077 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608359098 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608365059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608419895 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608424902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608480930 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608486891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608539104 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608547926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608603001 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608608961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608664036 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608669043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608728886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608740091 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608784914 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608788967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608843088 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608850002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608903885 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608911991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.608963013 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.608973026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609028101 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.609034061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609086990 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.609093904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609149933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609157085 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.609198093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609240055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609276056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609313011 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609348059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609414101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609471083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609510899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609545946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609580040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609612942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609647036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609689951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609752893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609800100 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609846115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609890938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609936953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.609982014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.610023022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.610058069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.610091925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.643040895 CET	49844	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:35.645673037 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.663335085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663393974 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663434029 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663479090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663518906 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663554907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663638115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663683891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663728952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663775921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663810968 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663830042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663846016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663861036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663908958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.663950920 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.664020061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.664066076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.664112091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.664156914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.664202929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.664247990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.664293051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.701591015 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.701828003 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.757481098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.757586956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.757679939 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.772424936 CET	80	49844	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:35.774112940 CET	80	49844	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:35.774159908 CET	80	49844	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:35.774348021 CET	49844	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:35.813935041 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.814007998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.814069986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.814131975 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.814217091 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.871906996 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.871968985 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.872018099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.872067928 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.872114897 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.872164965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.872205019 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.875543118 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.929379940 CET	49844	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:35.929634094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.929699898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.929761887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.929824114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.929847002 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.929887056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.929946899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.930157900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.930217028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.930236101 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.930278063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.930339098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.931503057 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.954520941 CET	49845	80	192.168.2.3	13.226.169.10
Jan 30, 2021 12:51:35.972178936 CET	49846	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:35.982858896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.982914925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.982964993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.983031988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.983083963 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.983305931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.983383894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.983428955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.983485937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.983501911 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.983586073 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.983596087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.983692884 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.983752966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.984417915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.984477043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.984535933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.984538078 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.984596014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.984656096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:35.985071898 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:35.992320061 CET	49847	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:35.999876022 CET	80	49845	13.226.169.10	192.168.2.3
Jan 30, 2021 12:51:36.000129938 CET	49845	80	192.168.2.3	13.226.169.10
Jan 30, 2021 12:51:36.000294924 CET	49845	80	192.168.2.3	13.226.169.10
Jan 30, 2021 12:51:36.025659084 CET	80	49846	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:36.025893927 CET	49846	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:36.026078939 CET	49846	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:36.036153078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.036218882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.036278963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.036339998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.036621094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.036674023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.036711931 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.036726952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.036755085 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.036777020 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.036847115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.036904097 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.036957026 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.036964893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.037000895 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.037045002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.037122011 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.037169933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.037425995 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.037525892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.037578106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.037626028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.037673950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.037722111 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.037730932 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.037770987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.037820101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.038016081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.038069010 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.038116932 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.038130999 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.038167000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.038214922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.038921118 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.045561075 CET	80	49845	13.226.169.10	192.168.2.3
Jan 30, 2021 12:51:36.046161890 CET	80	49845	13.226.169.10	192.168.2.3
Jan 30, 2021 12:51:36.046222925 CET	80	49845	13.226.169.10	192.168.2.3
Jan 30, 2021 12:51:36.046304941 CET	49845	80	192.168.2.3	13.226.169.10
Jan 30, 2021 12:51:36.054330111 CET	49845	80	192.168.2.3	13.226.169.10
Jan 30, 2021 12:51:36.054929018 CET	49848	80	192.168.2.3	13.226.169.4
Jan 30, 2021 12:51:36.055088043 CET	80	49844	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:36.079205990 CET	80	49846	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:36.079258919 CET	80	49846	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:36.079308033 CET	80	49846	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:36.079355955 CET	80	49846	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:36.079395056 CET	49846	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:36.079404116 CET	80	49846	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:36.079452038 CET	80	49846	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:36.079484940 CET	49846	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:36.079503059 CET	80	49846	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:36.079545021 CET	80	49846	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:36.079583883 CET	80	49846	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:36.079643965 CET	49846	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:36.081119061 CET	49846	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:36.090085983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090147018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090223074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090270996 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090320110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090370893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090378046 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.090419054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090470076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090518951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090581894 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.090590000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090641022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090688944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090738058 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090785027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090799093 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.090833902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090883017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090933084 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.090981960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091010094 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.091028929 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.091036081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091084957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091167927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091223001 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091231108 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.091274023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091295958 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.091352940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091403008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091465950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091470003 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.091521025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091557980 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091586113 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091634989 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091679096 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.091712952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091753006 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.091763973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091815948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091864109 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.091912031 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.092000008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.092050076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.092065096 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.092098951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.092148066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.092195988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.092761993 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.100959063 CET	80	49848	13.226.169.4	192.168.2.3
Jan 30, 2021 12:51:36.101063967 CET	80	49845	13.226.169.10	192.168.2.3
Jan 30, 2021 12:51:36.101509094 CET	49848	80	192.168.2.3	13.226.169.4
Jan 30, 2021 12:51:36.119673967 CET	80	49847	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:36.119874954 CET	49847	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:36.135991096 CET	80	49846	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:36.146382093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.146434069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.146485090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.146533012 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.146581888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.146630049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.146687984 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.146718979 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.147239923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147361040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147413015 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147463083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147506952 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.147511959 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147546053 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.147564888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147613049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147660971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147708893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147758007 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147805929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147819996 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.147855997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147903919 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147952080 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.147999048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148046970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148061037 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.148097992 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148147106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148195028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148242950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148289919 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148303986 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.148339033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148386955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148436069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148485899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148494005 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.148535013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148581982 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148628950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148677111 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148725033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148747921 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.148772955 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148822069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148869038 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148916006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148962975 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.148977995 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.149013042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149060965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149108887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149184942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149188042 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.149235964 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149285078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149333000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149379969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149451017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149466991 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.149583101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149645090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149704933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149764061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149785042 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.149825096 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149918079 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.149970055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.150018930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.150036097 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.150068045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.150096893 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.150154114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.150213003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.150268078 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.177406073 CET	49847	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:36.181792021 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.192066908 CET	49848	80	192.168.2.3	13.226.169.4
Jan 30, 2021 12:51:36.201014042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.201088905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.201178074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.201206923 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.201281071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.201344967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.201356888 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.201431990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.201524019 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.201572895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.201611996 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.201622963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.201930046 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.204749107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.204803944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.204853058 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.204869032 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.204902887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.204951048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.205117941 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.205307007 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.205388069 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.205420017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.205503941 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.205553055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.205601931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.205615044 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.205651999 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.205699921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.205746889 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.205795050 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.205842972 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.205852985 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.205893993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.205943108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.205990076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206037998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206087112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206100941 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.206136942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206185102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206233025 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206279993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206286907 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.206330061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206378937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206440926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206490040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206537962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206567049 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.206588984 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206636906 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206685066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206732035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206793070 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.206809044 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206866026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206924915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.206954956 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.206984997 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207026005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207065105 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207118988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207142115 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.207180977 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.207189083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207211018 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.207242966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207317114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207372904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207458019 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.207503080 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207565069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207623959 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207683086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207741022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207763910 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.207801104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207889080 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207947969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.207990885 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.208007097 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208026886 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.208066940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208127022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208209038 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.208218098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208278894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208338976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208399057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208457947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208518028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208545923 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.208579063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208637953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208719015 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208771944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208820105 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.208821058 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208872080 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208878040 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.208920956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.208969116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.209026098 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.209036112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.209093094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.209151983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.209212065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.209254026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.209295988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.209352016 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.209366083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.209443092 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.209474087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.209534883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.209593058 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.209651947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.209711075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.209769964 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.239267111 CET	80	49848	13.226.169.4	192.168.2.3
Jan 30, 2021 12:51:36.239689112 CET	80	49848	13.226.169.4	192.168.2.3
Jan 30, 2021 12:51:36.239991903 CET	80	49848	13.226.169.4	192.168.2.3
Jan 30, 2021 12:51:36.241616011 CET	49848	80	192.168.2.3	13.226.169.4
Jan 30, 2021 12:51:36.254754066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.254833937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.254897118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.254991055 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.255017042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.255029917 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.255074978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.255125046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.255173922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.255201101 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.255220890 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.255275011 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.255347967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.255398035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.255410910 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.255448103 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.255498886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.255501986 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.255547047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.255594969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.255642891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.255690098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.255703926 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.257890940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.257971048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.257987976 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.258064985 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.258117914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.258167028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.258215904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.258264065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.258279085 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.258313894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.258363008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.259521008 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.262594938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.262650013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.262698889 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.262747049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.262794971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.262839079 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.262842894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.262904882 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.262933969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.262988091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263036966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263087988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263124943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263151884 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263181925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263241053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263264894 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.263320923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263354063 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.263430119 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263489008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263508081 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.263592005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263652086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263710976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263770103 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263775110 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.263829947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263889074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.263948917 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264008045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264067888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264067888 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.264127016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264185905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264245987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264305115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264364004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264364004 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.264425039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264482975 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264543056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264600992 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.264602900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264662981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264722109 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264782906 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264837027 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.264848948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264869928 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.264924049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.264980078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265039921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265108109 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.265120029 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265170097 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265208006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265269041 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265347958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265357971 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.265366077 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.265430927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265480995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265532970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265580893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265629053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265676022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265692949 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.265724897 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265799046 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.265804052 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265863895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265911102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.265958071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266005993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266031027 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.266057968 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266105890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266153097 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266200066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266210079 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.266249895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266297102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266345024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266391039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266438007 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266453028 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.266488075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266536951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266586065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266633034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266680956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266695023 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.266730070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266777039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266825914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266872883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266920090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.266926050 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.266968966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267016888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267064095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267111063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267158985 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267163992 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.267206907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267256021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267302990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267349958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267398119 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267405033 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.267447948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267498016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267498016 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.267555952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267604113 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267651081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267698050 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267704964 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.267746925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.267795086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.268500090 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.305404902 CET	80	49847	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:36.306325912 CET	80	49847	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:36.306368113 CET	80	49847	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:36.307342052 CET	49847	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:36.308501005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.308554888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.308603048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.308651924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.308698893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.308747053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.308784008 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.308794975 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.308844090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.308891058 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.308938980 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.308954000 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.308984995 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.308999062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.309048891 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.309097052 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.309144020 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.309190989 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.309199095 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.311248064 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.311306953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.311366081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.311427116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.311433077 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.311496973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.311551094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.311599970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.312033892 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.312354088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.312412024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.312472105 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.312536955 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.320661068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.320730925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.320791960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.320852041 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.320867062 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.320914030 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.320972919 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.321063995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.321125984 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.321144104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.321203947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.321280003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.321322918 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.321352005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.321381092 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.321468115 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.321531057 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.327060938 CET	49847	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:36.327163935 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.380112886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380181074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380240917 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380300999 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380361080 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380420923 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380439997 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.380484104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380546093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380605936 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380665064 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380723953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380733013 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.380784035 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380877018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380928993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380978107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.380992889 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.381027937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381077051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381124973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381172895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381222963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381232977 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.381273031 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381320953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381369114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381434917 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.381454945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381515026 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381594896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381644011 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381686926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381705999 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.381742954 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381757021 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.381791115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381867886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381916046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.381931067 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.381966114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382014036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382052898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382088900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382117987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382145882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382183075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382251978 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.382262945 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382338047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382353067 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.382447958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382499933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382553101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382601976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382632017 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.382672071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382759094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382812977 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382833958 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.382863998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382883072 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.382915020 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.382962942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383009911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383057117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383105040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383130074 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.383155107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383158922 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.383203983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383250952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383299112 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383346081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383393049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383397102 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.383441925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383488894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383505106 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.383538961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383588076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383635044 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383682966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383730888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383737087 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.383779049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383827925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383889914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383938074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.383940935 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.383985996 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384033918 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384080887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384147882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384179115 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.384188890 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.384213924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384263039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384313107 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384360075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384407043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384454012 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384459972 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.384505033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384552956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384601116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384654045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384680986 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.384726048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384784937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384845018 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384903908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.384916067 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.384964943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385024071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385113001 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385163069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385185003 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.385212898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385248899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385299921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385348082 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385417938 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385466099 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385489941 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.385516882 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385564089 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385612011 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385658979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385679007 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.385706902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385711908 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.385756969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385834932 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.385931969 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.442421913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.442482948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.442537069 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.442573071 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.442608118 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.442621946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.442698956 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.442768097 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.442769051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.442778111 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.442863941 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.442877054 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.442936897 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.442992926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443043947 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.443053961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443114042 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443171978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443231106 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443289995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443293095 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.443348885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443414927 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443499088 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443543911 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.443557024 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.443559885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443619013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443619013 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.443685055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443767071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443834066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443846941 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.443911076 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.443918943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.443973064 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444010973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444037914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444078922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444113016 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.444154978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444190979 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.444200039 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.444212914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444262981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444310904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444359064 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444406986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444454908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444463968 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.444505930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444554090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444601059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444648981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444698095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444716930 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.444746971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444796085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444843054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444891930 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444940090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.444946051 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.444988966 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445038080 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445085049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445132971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445178986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445183039 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.445228100 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445276022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445322990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445369959 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445422888 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.445452929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445504904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445555925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445602894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445652008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445698977 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445708036 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.445748091 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445796967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445883036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445933104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.445946932 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.445985079 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446037054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446084976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446120977 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.446154118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446176052 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.446194887 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.446202993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446252108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446299076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446346998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446393967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446440935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446446896 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.446487904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446540117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446588039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446635008 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446696997 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.446707010 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446755886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446803093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446856976 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446903944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.446913004 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.446953058 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447000980 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447047949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447099924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447141886 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.447154999 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.447170019 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447226048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447284937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447344065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447402000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447455883 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.447460890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447521925 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447571039 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.447576046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447633028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447721958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447773933 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447823048 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447828054 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.447873116 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447881937 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.447921991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.447994947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.448044062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.448044062 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.448309898 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.452763081 CET	80	49847	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:36.501130104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501187086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501235962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501285076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501324892 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.501336098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501360893 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.501404047 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501502991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501553059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501605034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501621962 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.501656055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501658916 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.501704931 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501751900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501800060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501847982 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501867056 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.501878977 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.501895905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501920938 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.501946926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.501996040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502027988 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.502046108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502065897 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.502094984 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502171040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502219915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502268076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502275944 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.502317905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502366066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502413034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502460003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502506971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502513885 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.502557993 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502605915 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502654076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502696991 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.502728939 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502846003 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.502895117 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.502904892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.503351927 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.515718937 CET	49849	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:36.553569078 CET	49848	80	192.168.2.3	13.226.169.4
Jan 30, 2021 12:51:36.554038048 CET	49850	80	192.168.2.3	13.226.169.41
Jan 30, 2021 12:51:36.555351973 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.557579041 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.557626009 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.557677031 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.557739973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.557823896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.557853937 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.557877064 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.557926893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.557974100 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.558022022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.558068991 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.558116913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.558125019 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.558165073 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.558212996 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.558345079 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.558371067 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.598180056 CET	80	49850	13.226.169.41	192.168.2.3
Jan 30, 2021 12:51:36.598320007 CET	49850	80	192.168.2.3	13.226.169.41
Jan 30, 2021 12:51:36.599026918 CET	80	49848	13.226.169.4	192.168.2.3
Jan 30, 2021 12:51:36.608253002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.608316898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.608330011 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.608378887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.608556986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.608612061 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.608716011 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.608757973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.608827114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.608860970 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.608901978 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.608916998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.608983040 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.609030962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.609080076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.609127045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.609174013 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.609174967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.609224081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.609271049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.609318972 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.609368086 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.609420061 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.609451056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.611340046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.611396074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.611445904 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.611504078 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.611510992 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.611565113 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.611625910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.611692905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.611741066 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.612144947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.612199068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.612246990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.612293959 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.612341881 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.612355947 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.612390995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.612552881 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.612608910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.612657070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.612668991 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.612706900 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.612819910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.612952948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.613076925 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.643188000 CET	80	49849	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:36.643326998 CET	49849	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:36.662446022 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.662513971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.662576914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.662637949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.662698030 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.662718058 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.662772894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.662822962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.662872076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.662883043 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.662923098 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.662971973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663018942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663023949 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.663067102 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663115978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663162947 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663165092 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.663212061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663259983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663306952 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.663307905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663356066 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663403988 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663448095 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.663451910 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663500071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663548946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663572073 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.663590908 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.663600922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663650036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663697004 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663742065 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.663743973 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.663793087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.666084051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.666137934 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.666150093 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.666238070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.666299105 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.666348934 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.666361094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.666419983 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.666477919 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.666523933 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.666539907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.666636944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.666695118 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.666697979 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.666788101 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.666831017 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.666870117 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.666953087 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667002916 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.667033911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667108059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667157888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667205095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667252064 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667252064 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.667300940 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667347908 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667395115 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.667395115 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667445898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667493105 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667536020 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.667543888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667593002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667640924 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667687893 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667687893 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.667737007 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667784929 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.667833090 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.667834044 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.692495108 CET	49849	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:36.719032049 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719099045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719161987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719172955 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.719217062 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.719248056 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719297886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719346046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719393969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719410896 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.719444036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719492912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719532013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719568968 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.719599962 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719666958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719706059 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.719717979 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.719722033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719778061 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719829082 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719876051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719882965 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.719926119 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.719974041 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720021009 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720024109 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.720069885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720118046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720197916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720233917 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.720252037 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720303059 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720304012 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.720352888 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720400095 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720448017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720494986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720514059 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.720581055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720659018 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.720659971 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720721960 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720768929 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.720798969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720874071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720933914 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.720988989 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.721024036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.721082926 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.721142054 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.721200943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.721200943 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.721261024 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.721322060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.721375942 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.721380949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.721471071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.723360062 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.723418951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.723437071 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.723479986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.723536015 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.723541021 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.723601103 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.723660946 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.723716021 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.723720074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.723782063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.723839998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.723893881 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.723897934 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.723958969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724018097 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724070072 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.724076986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724137068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724196911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724251032 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.724256039 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724317074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724375963 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724433899 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724442005 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.724493027 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724553108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724611998 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724612951 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.724670887 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724730015 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724786043 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.724787951 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724849939 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724909067 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724967957 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.724967957 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.726571083 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.726632118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.726730108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.726732016 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.726783991 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.726800919 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.726860046 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.726952076 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.726957083 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.727010012 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727080107 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.727081060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727184057 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727236986 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727277040 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.727302074 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727365017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727412939 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.727468967 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727521896 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727538109 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.727574110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727626085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727663994 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727690935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727736950 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727783918 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.727792978 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727850914 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.727855921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727905989 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.727953911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.728002071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.728008032 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.728053093 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.728766918 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.777637005 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.777678013 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.777714014 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.777797937 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.777849913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.777899981 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.777901888 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.777947903 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.777951002 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.777955055 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.778001070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778048992 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778095961 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778104067 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.778145075 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778192043 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778239012 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778243065 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.778286934 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778335094 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778383017 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778383970 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.778431892 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778486967 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.778506041 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778558969 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778611898 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778641939 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.778659105 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.778662920 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778711081 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778784990 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778810024 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.778866053 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778924942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.778985023 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779036045 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.779043913 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779103994 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779165030 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779172897 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.779225111 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779278994 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.779314995 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779366016 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779413939 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779427052 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.779464006 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779530048 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.779539108 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779599905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779659033 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779711962 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.779717922 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779831886 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779902935 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.779937983 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.779962063 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.780009031 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.780020952 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.780081034 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.780811071 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.780864000 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.780869007 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.780914068 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.780962944 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781011105 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781013012 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.781059980 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781106949 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781153917 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781157017 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.781203032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781250954 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781299114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781299114 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.781347036 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781440973 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.781452894 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781523943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781577110 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781625032 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781629086 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.781675100 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781712055 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:36.781837940 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:36.821116924 CET	80	49849	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:36.825203896 CET	80	49849	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:36.825270891 CET	80	49849	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:36.825436115 CET	49849	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:36.853509903 CET	49849	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:36.979348898 CET	80	49849	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:39.096642971 CET	443	49816	54.208.194.17	192.168.2.3
Jan 30, 2021 12:51:39.096792936 CET	49816	443	192.168.2.3	54.208.194.17
Jan 30, 2021 12:51:39.893711090 CET	49851	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:39.894766092 CET	49852	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:39.895380020 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.899823904 CET	49850	80	192.168.2.3	13.226.169.41
Jan 30, 2021 12:51:39.944014072 CET	80	49850	13.226.169.41	192.168.2.3
Jan 30, 2021 12:51:39.944386005 CET	80	49850	13.226.169.41	192.168.2.3
Jan 30, 2021 12:51:39.944442987 CET	80	49850	13.226.169.41	192.168.2.3
Jan 30, 2021 12:51:39.944514036 CET	49850	80	192.168.2.3	13.226.169.41
Jan 30, 2021 12:51:39.944704056 CET	49850	80	192.168.2.3	13.226.169.41
Jan 30, 2021 12:51:39.944880962 CET	49853	80	192.168.2.3	13.226.169.78
Jan 30, 2021 12:51:39.948324919 CET	80	49852	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:39.948489904 CET	49852	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:39.948571920 CET	49852	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:39.948649883 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.948700905 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.948750019 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.948798895 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.948867083 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.948880911 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.948909998 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.948940992 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.948991060 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949048996 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.949071884 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949125051 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949172974 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949219942 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949239016 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.949268103 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949325085 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949378967 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.949379921 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949469090 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949517965 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949564934 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949606895 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.949611902 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949661970 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949708939 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949755907 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949771881 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.949805975 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949852943 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949901104 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949947119 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.949961901 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.949996948 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950043917 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950090885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950098038 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.950140953 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950189114 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950236082 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950242996 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.950285912 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950333118 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950381041 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950385094 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.950429916 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950476885 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950525045 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950540066 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.950572968 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950620890 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950668097 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950675011 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.950715065 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950762987 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950810909 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950810909 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.950859070 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950906038 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:39.950957060 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.951128006 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:39.989573002 CET	80	49853	13.226.169.78	192.168.2.3
Jan 30, 2021 12:51:39.989641905 CET	80	49850	13.226.169.41	192.168.2.3
Jan 30, 2021 12:51:39.989696026 CET	49853	80	192.168.2.3	13.226.169.78
Jan 30, 2021 12:51:39.989830017 CET	49853	80	192.168.2.3	13.226.169.78
Jan 30, 2021 12:51:40.004199028 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:40.004287958 CET	80	49826	178.79.242.16	192.168.2.3
Jan 30, 2021 12:51:40.004295111 CET	49826	80	192.168.2.3	178.79.242.16
Jan 30, 2021 12:51:40.004337072 CET	80	49852	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.004528999 CET	80	49852	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.004614115 CET	80	49852	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.004666090 CET	80	49852	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.004715919 CET	80	49852	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.004765034 CET	80	49852	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.004800081 CET	49852	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.004817009 CET	80	49852	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.004829884 CET	49852	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.004859924 CET	80	49852	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.004895926 CET	80	49852	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.004925013 CET	49852	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.004950047 CET	49852	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.006388903 CET	49852	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.019921064 CET	80	49851	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:40.020400047 CET	49851	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:40.020446062 CET	49851	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:40.035202026 CET	80	49853	13.226.169.78	192.168.2.3
Jan 30, 2021 12:51:40.035451889 CET	80	49853	13.226.169.78	192.168.2.3
Jan 30, 2021 12:51:40.035788059 CET	80	49853	13.226.169.78	192.168.2.3
Jan 30, 2021 12:51:40.035926104 CET	49853	80	192.168.2.3	13.226.169.78
Jan 30, 2021 12:51:40.036412001 CET	49853	80	192.168.2.3	13.226.169.78
Jan 30, 2021 12:51:40.059155941 CET	49854	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.061407089 CET	80	49852	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.081363916 CET	80	49853	13.226.169.78	192.168.2.3
Jan 30, 2021 12:51:40.114408970 CET	80	49854	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.114521027 CET	49854	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.148189068 CET	80	49851	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:40.149034977 CET	80	49851	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:40.149080038 CET	80	49851	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:40.149378061 CET	49851	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:40.149422884 CET	49851	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:40.169770956 CET	49854	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.216113091 CET	49855	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:40.225362062 CET	80	49854	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.225658894 CET	80	49854	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.225718975 CET	80	49854	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.225769997 CET	80	49854	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.225821018 CET	80	49854	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.225843906 CET	49854	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.225867987 CET	49854	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.225873947 CET	80	49854	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.225924015 CET	80	49854	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.225965023 CET	80	49854	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.225972891 CET	49854	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.226003885 CET	80	49854	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.226052046 CET	49854	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.277235031 CET	80	49851	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:40.342080116 CET	80	49855	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:40.343178988 CET	49855	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:40.343246937 CET	49855	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:40.347678900 CET	49854	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.405088902 CET	80	49854	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.471285105 CET	80	49855	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:40.472384930 CET	80	49855	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:40.472445965 CET	80	49855	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:40.472646952 CET	49855	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:40.472711086 CET	49855	80	192.168.2.3	54.243.113.215
Jan 30, 2021 12:51:40.540883064 CET	49856	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:40.598516941 CET	80	49855	54.243.113.215	192.168.2.3
Jan 30, 2021 12:51:40.627366066 CET	49857	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.669903040 CET	80	49856	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:40.670075893 CET	49856	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:40.670134068 CET	49856	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:40.683115005 CET	80	49857	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.683258057 CET	49857	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.781650066 CET	49857	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.796618938 CET	80	49856	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:40.798466921 CET	80	49856	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:40.798518896 CET	80	49856	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:40.798576117 CET	49856	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:40.809511900 CET	49856	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:40.834770918 CET	80	49857	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.835448980 CET	80	49857	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.835500956 CET	80	49857	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.835550070 CET	80	49857	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.835561037 CET	49857	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.835598946 CET	80	49857	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.835647106 CET	80	49857	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.835650921 CET	49857	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.835695028 CET	80	49857	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.835737944 CET	80	49857	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.835745096 CET	49857	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.835772991 CET	80	49857	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:40.835824013 CET	49857	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:40.936337948 CET	80	49856	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:40.944550037 CET	49858	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:41.070571899 CET	80	49858	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:41.070781946 CET	49858	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:41.741049051 CET	49858	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:41.867618084 CET	80	49858	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:41.868269920 CET	80	49858	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:41.868324041 CET	80	49858	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:41.868427038 CET	49858	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:41.959428072 CET	49858	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:42.086146116 CET	80	49858	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:42.681803942 CET	49859	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:42.809850931 CET	80	49859	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:42.810045004 CET	49859	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:42.810580969 CET	49859	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:42.938584089 CET	80	49859	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:42.939124107 CET	80	49859	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:42.939264059 CET	80	49859	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:42.939409971 CET	49859	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:42.952928066 CET	49859	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:42.968436003 CET	49857	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.021492958 CET	80	49857	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.027782917 CET	49860	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:43.079370975 CET	80	49859	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:43.153517008 CET	80	49860	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:43.153659105 CET	49860	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:43.157336950 CET	49860	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:43.194068909 CET	49861	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.249208927 CET	80	49861	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.249428988 CET	49861	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.283085108 CET	80	49860	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:43.284235001 CET	80	49860	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:43.284295082 CET	80	49860	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:43.284389973 CET	49860	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:43.284432888 CET	49860	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:43.337826014 CET	49861	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.341242075 CET	49862	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:43.395136118 CET	80	49861	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.395587921 CET	80	49861	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.395646095 CET	80	49861	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.395694971 CET	80	49861	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.395745039 CET	80	49861	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.395749092 CET	49861	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.395791054 CET	49861	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.395793915 CET	80	49861	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.395843983 CET	80	49861	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.395884991 CET	80	49861	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.395895958 CET	49861	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.395921946 CET	80	49861	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.395972967 CET	49861	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.412421942 CET	80	49860	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:43.464446068 CET	49861	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.469719887 CET	80	49862	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:43.469912052 CET	49862	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:43.469965935 CET	49862	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:43.519669056 CET	80	49861	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.597626925 CET	80	49862	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:43.599904060 CET	80	49862	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:43.599963903 CET	80	49862	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:43.600136995 CET	49862	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:43.600203037 CET	49862	80	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:43.654135942 CET	49863	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.675399065 CET	49864	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:43.707556963 CET	80	49863	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.707756996 CET	49863	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.726466894 CET	80	49862	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:43.776940107 CET	49863	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.801217079 CET	80	49864	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:43.801361084 CET	49864	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:43.801482916 CET	49864	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:43.831943035 CET	80	49863	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.832015038 CET	80	49863	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.832072973 CET	80	49863	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.832144022 CET	80	49863	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.832206011 CET	80	49863	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.832206011 CET	49863	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.832254887 CET	49863	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.832262039 CET	80	49863	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.832319021 CET	80	49863	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.832372904 CET	49863	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.832374096 CET	80	49863	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.832423925 CET	80	49863	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.832472086 CET	49863	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.873250008 CET	49863	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:43.926493883 CET	80	49863	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:43.928407907 CET	80	49864	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:43.929306030 CET	80	49864	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:43.929351091 CET	80	49864	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:43.929455042 CET	49864	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:43.942059040 CET	49864	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:44.022598982 CET	49865	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:44.069370985 CET	80	49864	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:44.096040010 CET	49866	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.151043892 CET	80	49865	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:44.151225090 CET	49865	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:44.151611090 CET	49865	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:44.155985117 CET	80	49866	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.156078100 CET	49866	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.264354944 CET	49866	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.277287006 CET	80	49865	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:44.280761957 CET	80	49865	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:44.280807972 CET	80	49865	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:44.280877113 CET	49865	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:44.283607006 CET	49865	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:44.321337938 CET	80	49866	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.321634054 CET	80	49866	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.321691036 CET	80	49866	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.321743011 CET	80	49866	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.321783066 CET	49866	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.321794987 CET	80	49866	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.321845055 CET	80	49866	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.321846962 CET	49866	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.321893930 CET	80	49866	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.321935892 CET	80	49866	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.321940899 CET	49866	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.321973085 CET	80	49866	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.322017908 CET	49866	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.340676069 CET	49867	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:44.356349945 CET	49866	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.409297943 CET	80	49865	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:44.413290024 CET	80	49866	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.466797113 CET	80	49867	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:44.467047930 CET	49867	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:44.474318981 CET	49867	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:44.589390039 CET	49868	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.600267887 CET	80	49867	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:44.601054907 CET	80	49867	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:44.601125002 CET	80	49867	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:44.601253033 CET	49867	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:44.603368044 CET	49867	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:44.644293070 CET	80	49868	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.644453049 CET	49868	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.666630983 CET	49869	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:44.670340061 CET	49868	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.722433090 CET	80	49868	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.722590923 CET	80	49868	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.722650051 CET	80	49868	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.722712040 CET	80	49868	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.722749949 CET	49868	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.722773075 CET	80	49868	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.722831011 CET	80	49868	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.722831964 CET	49868	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.722929955 CET	80	49868	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.722981930 CET	49868	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.722984076 CET	80	49868	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.723032951 CET	80	49868	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.723078966 CET	49868	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.731427908 CET	80	49867	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:44.787518978 CET	49868	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.792608976 CET	80	49869	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:44.792727947 CET	49869	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:44.839732885 CET	80	49868	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:44.862632036 CET	49869	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:44.982482910 CET	49870	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:44.988624096 CET	80	49869	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:44.989989996 CET	80	49869	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:44.990039110 CET	80	49869	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:44.990099907 CET	49869	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:44.990137100 CET	49869	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:45.037300110 CET	80	49870	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.037473917 CET	49870	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.059024096 CET	49871	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:45.117602110 CET	80	49869	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:45.135552883 CET	49870	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.185076952 CET	80	49871	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:45.185220957 CET	49871	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:45.185307980 CET	49871	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:45.188863993 CET	80	49870	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.189162016 CET	80	49870	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.189224958 CET	80	49870	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.189286947 CET	80	49870	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.189312935 CET	49870	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.189346075 CET	80	49870	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.189400911 CET	49870	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.189425945 CET	80	49870	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.189485073 CET	80	49870	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.189538002 CET	80	49870	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.189543962 CET	49870	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.189584017 CET	80	49870	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.189634085 CET	49870	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.283601046 CET	49870	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.311384916 CET	80	49871	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:45.312268972 CET	80	49871	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:45.312334061 CET	80	49871	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:45.312431097 CET	49871	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:45.337707996 CET	80	49870	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.359921932 CET	49871	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:45.424623966 CET	49872	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:45.488169909 CET	80	49871	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:45.526206017 CET	49873	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.552808046 CET	80	49872	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:45.552963972 CET	49872	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:45.553040981 CET	49872	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:45.580962896 CET	80	49873	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.581093073 CET	49873	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.664127111 CET	49873	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.679241896 CET	80	49872	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:45.681231976 CET	80	49872	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:45.681299925 CET	80	49872	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:45.681413889 CET	49872	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:45.684215069 CET	49872	80	192.168.2.3	23.21.217.194
Jan 30, 2021 12:51:45.718815088 CET	80	49873	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.718909025 CET	80	49873	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.718971968 CET	80	49873	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.719033003 CET	80	49873	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.719093084 CET	80	49873	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.719098091 CET	49873	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.719153881 CET	80	49873	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.719172955 CET	49873	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.719213963 CET	80	49873	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.719268084 CET	80	49873	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.719286919 CET	49873	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.719320059 CET	80	49873	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:45.719391108 CET	49873	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.744868994 CET	49874	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:45.810580015 CET	80	49872	23.21.217.194	192.168.2.3
Jan 30, 2021 12:51:45.871054888 CET	80	49874	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:45.871285915 CET	49874	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:45.878544092 CET	49874	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:45.879302979 CET	49873	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:45.935959101 CET	80	49873	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.007286072 CET	80	49874	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.007989883 CET	80	49874	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.008032084 CET	80	49874	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.008228064 CET	49874	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:46.008272886 CET	49874	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:46.032674074 CET	49875	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.088928938 CET	80	49875	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.089112997 CET	49875	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.107500076 CET	49876	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:46.134125948 CET	80	49874	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.158823013 CET	49875	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.216957092 CET	80	49875	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.217331886 CET	80	49875	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.217418909 CET	80	49875	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.217475891 CET	80	49875	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.217525005 CET	80	49875	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.217569113 CET	80	49875	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.217603922 CET	49875	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.217622042 CET	80	49875	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.217643023 CET	49875	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.217664003 CET	80	49875	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.217684984 CET	49875	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.217735052 CET	80	49875	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.217797041 CET	49875	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.233107090 CET	80	49876	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.233298063 CET	49876	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:46.233355045 CET	49876	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:46.281384945 CET	49875	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.337616920 CET	80	49875	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.361217976 CET	80	49876	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.362183094 CET	80	49876	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.362226963 CET	80	49876	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.362361908 CET	49876	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:46.368638992 CET	49876	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:46.486208916 CET	49877	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:46.494319916 CET	80	49876	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.601083040 CET	49878	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.611983061 CET	80	49877	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.623249054 CET	49877	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:46.624315977 CET	49877	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:46.656337976 CET	80	49878	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.673453093 CET	49878	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.736280918 CET	49878	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.749943018 CET	80	49877	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.750834942 CET	80	49877	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.750905991 CET	80	49877	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.756189108 CET	49877	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:46.756263018 CET	49877	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:46.792428017 CET	80	49878	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.792881012 CET	80	49878	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.792938948 CET	80	49878	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.792990923 CET	80	49878	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.793040037 CET	80	49878	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.793088913 CET	80	49878	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.793137074 CET	80	49878	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.793179035 CET	80	49878	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.793214083 CET	80	49878	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.807559013 CET	49878	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.809657097 CET	49878	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.865326881 CET	80	49878	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.884598970 CET	80	49877	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:46.910979033 CET	49879	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:46.914891958 CET	49880	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:46.964724064 CET	80	49879	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:46.976161957 CET	49879	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.021215916 CET	49879	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.040740013 CET	80	49880	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.062553883 CET	49880	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:47.064966917 CET	49880	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:47.074774027 CET	80	49879	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.074846983 CET	80	49879	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.074901104 CET	80	49879	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.074951887 CET	80	49879	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.075002909 CET	80	49879	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.075051069 CET	80	49879	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.075099945 CET	80	49879	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.075141907 CET	80	49879	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.075177908 CET	80	49879	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.078758001 CET	49879	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.130721092 CET	49879	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.183938026 CET	80	49879	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.190716982 CET	80	49880	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.192367077 CET	80	49880	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.192405939 CET	80	49880	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.195825100 CET	49880	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:47.215186119 CET	49880	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:47.292658091 CET	49881	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:47.327332973 CET	49882	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.341029882 CET	80	49880	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.380455017 CET	80	49882	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.394876957 CET	49882	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.420617104 CET	80	49881	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.428656101 CET	49881	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:47.429080009 CET	49881	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:47.430138111 CET	49882	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.485378027 CET	80	49882	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.485826015 CET	80	49882	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.485882998 CET	80	49882	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.485932112 CET	80	49882	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.485981941 CET	80	49882	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.486078978 CET	80	49882	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.486162901 CET	80	49882	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.486198902 CET	80	49882	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.486253023 CET	80	49882	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.503906965 CET	49882	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.505657911 CET	49882	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.523062944 CET	49882	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.557502985 CET	80	49881	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.558549881 CET	80	49881	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.558604002 CET	80	49881	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.558648109 CET	80	49882	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.561539888 CET	49881	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:47.600917101 CET	49881	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:47.661261082 CET	49883	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.704521894 CET	49884	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:47.713785887 CET	80	49883	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.722639084 CET	49883	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.729840994 CET	80	49881	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.766499043 CET	49883	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.818957090 CET	80	49883	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.819037914 CET	80	49883	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.819099903 CET	80	49883	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.819159985 CET	80	49883	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.819217920 CET	80	49883	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.819273949 CET	80	49883	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.819334030 CET	80	49883	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.819387913 CET	80	49883	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.819436073 CET	80	49883	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.824299097 CET	49883	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.830854893 CET	80	49884	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.842979908 CET	49884	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:47.846868992 CET	49884	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:47.880048037 CET	49883	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:47.934568882 CET	80	49883	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:47.974503040 CET	80	49884	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.976212025 CET	80	49884	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.976273060 CET	80	49884	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:47.983735085 CET	49884	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:47.984453917 CET	49884	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.057666063 CET	49885	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.097093105 CET	49886	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:48.112658024 CET	80	49884	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:48.149379969 CET	80	49886	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.178806067 CET	49886	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:48.185477972 CET	80	49885	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:48.193761110 CET	49885	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.195033073 CET	49885	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.230185032 CET	49886	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:48.285262108 CET	80	49886	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.285676956 CET	80	49886	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.285737991 CET	80	49886	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.285799026 CET	80	49886	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.285857916 CET	80	49886	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.285917044 CET	80	49886	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.285978079 CET	80	49886	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.286030054 CET	80	49886	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.286078930 CET	80	49886	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.301798105 CET	49886	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:48.323875904 CET	80	49885	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:48.325010061 CET	80	49885	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:48.325053930 CET	80	49885	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:48.335146904 CET	49885	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.335306883 CET	49885	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.425450087 CET	49887	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.452111959 CET	49886	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:48.461421967 CET	80	49885	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:48.504601002 CET	80	49886	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.554512024 CET	80	49887	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:48.574157000 CET	49887	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.574223042 CET	49887	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.576641083 CET	49888	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:48.629076004 CET	80	49888	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.632293940 CET	49888	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:48.700886965 CET	80	49887	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:48.702688932 CET	80	49887	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:48.702759027 CET	80	49887	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:48.707160950 CET	49888	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:48.718487024 CET	49887	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.718607903 CET	49887	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.760036945 CET	80	49888	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.760113955 CET	80	49888	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.760169029 CET	80	49888	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.760219097 CET	80	49888	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.760267019 CET	80	49888	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.760317087 CET	80	49888	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.760365963 CET	80	49888	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.760409117 CET	80	49888	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.760446072 CET	80	49888	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.768526077 CET	49888	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:48.784158945 CET	49889	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.797749996 CET	49888	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:48.845238924 CET	80	49887	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:48.853889942 CET	80	49888	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:48.912806034 CET	80	49889	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:48.923932076 CET	49889	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.924388885 CET	49889	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:48.947185040 CET	443	49728	204.79.197.200	192.168.2.3
Jan 30, 2021 12:51:48.997055054 CET	49890	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.050158024 CET	80	49889	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:49.051207066 CET	80	49889	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:49.051266909 CET	80	49889	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:49.052568913 CET	80	49890	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.058005095 CET	49890	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.058032990 CET	49889	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:49.058808088 CET	49889	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:49.061243057 CET	49890	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.113898993 CET	49891	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:49.116286039 CET	80	49890	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.116645098 CET	80	49890	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.116700888 CET	80	49890	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.116753101 CET	80	49890	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.116782904 CET	49890	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.116801023 CET	80	49890	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.116849899 CET	80	49890	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.116858959 CET	49890	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.116900921 CET	80	49890	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.116936922 CET	80	49890	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.116970062 CET	49890	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.116988897 CET	80	49890	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.117258072 CET	49890	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.119000912 CET	49890	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.175153017 CET	80	49890	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.185463905 CET	80	49889	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:49.236195087 CET	49892	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.239773035 CET	80	49891	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:49.240045071 CET	49891	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:49.240112066 CET	49891	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:49.288479090 CET	80	49892	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.288677931 CET	49892	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.350763083 CET	49892	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.365910053 CET	80	49891	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:49.366621971 CET	80	49891	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:49.366667986 CET	80	49891	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:49.366812944 CET	49891	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:49.370682955 CET	49891	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:51:49.402997017 CET	80	49892	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.403357983 CET	80	49892	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.403414011 CET	80	49892	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.403464079 CET	80	49892	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.403511047 CET	80	49892	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.403563023 CET	80	49892	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.403579950 CET	49892	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.403601885 CET	80	49892	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.403642893 CET	49892	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.403654099 CET	80	49892	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.403661966 CET	49892	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.403693914 CET	80	49892	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.403753996 CET	49892	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.495834112 CET	49892	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.496239901 CET	80	49891	50.17.220.153	192.168.2.3
Jan 30, 2021 12:51:49.548146009 CET	80	49892	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.734757900 CET	49893	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.788857937 CET	80	49893	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.789078951 CET	49893	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.856929064 CET	49893	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.911062956 CET	80	49893	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.911371946 CET	80	49893	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.911432028 CET	80	49893	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.911499023 CET	80	49893	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.911511898 CET	49893	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.911569118 CET	80	49893	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.911623955 CET	80	49893	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.911636114 CET	49893	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.911695957 CET	80	49893	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.911741018 CET	80	49893	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.911756992 CET	49893	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.911792994 CET	80	49893	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:49.911849022 CET	49893	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.913559914 CET	49893	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:49.967822075 CET	80	49893	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.043119907 CET	49894	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.095731020 CET	80	49894	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.095961094 CET	49894	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.102895021 CET	49894	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.157082081 CET	80	49894	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.157301903 CET	80	49894	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.157361031 CET	80	49894	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.157443047 CET	80	49894	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.157464981 CET	49894	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.157496929 CET	80	49894	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.157546997 CET	80	49894	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.157577991 CET	49894	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.157598019 CET	80	49894	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.157640934 CET	80	49894	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.157659054 CET	49894	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.157685995 CET	80	49894	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.157743931 CET	49894	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.171547890 CET	49894	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.224600077 CET	80	49894	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.336482048 CET	49895	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.389941931 CET	80	49895	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.390124083 CET	49895	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.401803017 CET	49895	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.455169916 CET	80	49895	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.455245972 CET	80	49895	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.455298901 CET	80	49895	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.455348015 CET	80	49895	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.455365896 CET	49895	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.455399990 CET	80	49895	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.455451012 CET	80	49895	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.455457926 CET	49895	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.455498934 CET	80	49895	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.455542088 CET	80	49895	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.455563068 CET	49895	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.455578089 CET	80	49895	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.455635071 CET	49895	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.457565069 CET	49895	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.512295961 CET	80	49895	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.580444098 CET	49896	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.636624098 CET	80	49896	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.636908054 CET	49896	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.679904938 CET	49896	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.737946987 CET	80	49896	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.738018036 CET	80	49896	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.738075972 CET	80	49896	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.738136053 CET	80	49896	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.738194942 CET	80	49896	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.738223076 CET	49896	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.738250971 CET	80	49896	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.738266945 CET	49896	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.738308907 CET	80	49896	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.738363028 CET	80	49896	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.738367081 CET	49896	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.738411903 CET	80	49896	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:50.738464117 CET	49896	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.797081947 CET	49896	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:50.853244066 CET	80	49896	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.001693010 CET	49897	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.057039022 CET	80	49897	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.057194948 CET	49897	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.158806086 CET	49897	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.214006901 CET	80	49897	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.214219093 CET	80	49897	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.214287996 CET	80	49897	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.214349031 CET	80	49897	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.214390993 CET	49897	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.214440107 CET	80	49897	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.214493990 CET	49897	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.214519024 CET	80	49897	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.214570999 CET	80	49897	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.214622021 CET	80	49897	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.214637995 CET	49897	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.214687109 CET	80	49897	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.214735985 CET	49897	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.264939070 CET	49897	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.321670055 CET	80	49897	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.492304087 CET	49898	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.546616077 CET	80	49898	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.546892881 CET	49898	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.608575106 CET	49898	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.662908077 CET	80	49898	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.663364887 CET	80	49898	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.663428068 CET	80	49898	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.663489103 CET	80	49898	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.663548946 CET	80	49898	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.663609982 CET	80	49898	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.663608074 CET	49898	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.663649082 CET	49898	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.663671970 CET	80	49898	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.663726091 CET	80	49898	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.663738012 CET	49898	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.663777113 CET	80	49898	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.663836002 CET	49898	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.744621992 CET	49898	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:51.799065113 CET	80	49898	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:51.998838902 CET	49899	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.056673050 CET	80	49899	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.056801081 CET	49899	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.085767984 CET	49899	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.144217968 CET	80	49899	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.144383907 CET	80	49899	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.144438982 CET	80	49899	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.144488096 CET	80	49899	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.144515991 CET	49899	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.144539118 CET	80	49899	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.144587994 CET	80	49899	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.144593000 CET	49899	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.144635916 CET	80	49899	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.144678116 CET	80	49899	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.144690990 CET	49899	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.144715071 CET	80	49899	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.144784927 CET	49899	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.261046886 CET	49899	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.317157984 CET	80	49899	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.502971888 CET	49900	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.557292938 CET	80	49900	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.557508945 CET	49900	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.620501995 CET	49900	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.674690008 CET	80	49900	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.674981117 CET	80	49900	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.675034046 CET	80	49900	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.675084114 CET	80	49900	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.675101042 CET	49900	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.675132036 CET	80	49900	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.675180912 CET	80	49900	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.675184965 CET	49900	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.675229073 CET	80	49900	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.675271988 CET	80	49900	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.675276995 CET	49900	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.675307989 CET	80	49900	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:52.675362110 CET	49900	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.787096024 CET	49900	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:52.841542959 CET	80	49900	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.028322935 CET	49901	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.084497929 CET	80	49901	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.084670067 CET	49901	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.172039032 CET	49901	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.228308916 CET	80	49901	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.228542089 CET	80	49901	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.228606939 CET	80	49901	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.228667974 CET	80	49901	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.228729010 CET	80	49901	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.228789091 CET	49901	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.228791952 CET	80	49901	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.228817940 CET	49901	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.228851080 CET	80	49901	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.228904963 CET	80	49901	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.228913069 CET	49901	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.228954077 CET	80	49901	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.229017019 CET	49901	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.289860010 CET	49901	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.348822117 CET	80	49901	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.649642944 CET	49902	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.705741882 CET	80	49902	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.705965042 CET	49902	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.787111998 CET	49902	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.843128920 CET	80	49902	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.843204021 CET	80	49902	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.843259096 CET	80	49902	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.843308926 CET	80	49902	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.843358994 CET	80	49902	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.843409061 CET	80	49902	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.843460083 CET	80	49902	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.843470097 CET	49902	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.843499899 CET	49902	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.843503952 CET	80	49902	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.843534946 CET	49902	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.843538046 CET	80	49902	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:53.843605042 CET	49902	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.916910887 CET	49902	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:53.970269918 CET	80	49902	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.139323950 CET	49903	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.194905996 CET	80	49903	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.195178986 CET	49903	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.243643999 CET	49903	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.297863960 CET	80	49903	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.298222065 CET	80	49903	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.298280954 CET	80	49903	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.298332930 CET	80	49903	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.298377991 CET	49903	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.298383951 CET	80	49903	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.298434019 CET	80	49903	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.298449039 CET	49903	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.298485041 CET	80	49903	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.298526049 CET	80	49903	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.298540115 CET	49903	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.298557997 CET	80	49903	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.298614025 CET	49903	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.331928015 CET	49903	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.388339996 CET	80	49903	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.527801037 CET	49904	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.583738089 CET	80	49904	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.583903074 CET	49904	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.652374029 CET	49904	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.706377983 CET	80	49904	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.706886053 CET	80	49904	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.706943989 CET	80	49904	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.706993103 CET	80	49904	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.707021952 CET	49904	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.707073927 CET	80	49904	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.707129002 CET	49904	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.707158089 CET	80	49904	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.707211018 CET	80	49904	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.707257986 CET	80	49904	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.707268953 CET	49904	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.707304001 CET	80	49904	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:54.707353115 CET	49904	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.853477001 CET	49904	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:54.906543970 CET	80	49904	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.411360979 CET	49905	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.464688063 CET	80	49905	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.464916945 CET	49905	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.518249035 CET	49905	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.573566914 CET	80	49905	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.573972940 CET	80	49905	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.574031115 CET	80	49905	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.574081898 CET	80	49905	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.574135065 CET	80	49905	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.574158907 CET	49905	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.574184895 CET	80	49905	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.574196100 CET	49905	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.574239969 CET	80	49905	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.574297905 CET	80	49905	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.574311018 CET	49905	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.574338913 CET	80	49905	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.574393988 CET	49905	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.680753946 CET	49905	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.735508919 CET	80	49905	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.790863991 CET	49906	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.843139887 CET	80	49906	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.843360901 CET	49906	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.874392033 CET	49906	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.926695108 CET	80	49906	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.926760912 CET	80	49906	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.926810980 CET	80	49906	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.926858902 CET	80	49906	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.926876068 CET	49906	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.926908970 CET	80	49906	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.926955938 CET	80	49906	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.926964998 CET	49906	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.927004099 CET	80	49906	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.927045107 CET	80	49906	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.927062035 CET	49906	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.927081108 CET	80	49906	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:55.927139044 CET	49906	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.928843021 CET	49906	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:55.981193066 CET	80	49906	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.019371986 CET	49907	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.073596001 CET	80	49907	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.073779106 CET	49907	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.128480911 CET	49907	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.180778027 CET	80	49907	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.180859089 CET	80	49907	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.180923939 CET	80	49907	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.180984020 CET	80	49907	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.181046963 CET	80	49907	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.181050062 CET	49907	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.181108952 CET	80	49907	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.181149006 CET	49907	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.181173086 CET	80	49907	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.181245089 CET	80	49907	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.181283951 CET	49907	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.181294918 CET	80	49907	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.181365967 CET	49907	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.267293930 CET	49907	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.319767952 CET	80	49907	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.551379919 CET	49908	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.609100103 CET	80	49908	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.609319925 CET	49908	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.622550011 CET	49908	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.680803061 CET	80	49908	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.681404114 CET	80	49908	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.681477070 CET	80	49908	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.681536913 CET	80	49908	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.681556940 CET	49908	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.681597948 CET	80	49908	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.681657076 CET	80	49908	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.681662083 CET	49908	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.681715965 CET	80	49908	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.681768894 CET	80	49908	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.681775093 CET	49908	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.681816101 CET	80	49908	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.681866884 CET	49908	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.683996916 CET	49908	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.740515947 CET	80	49908	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.799055099 CET	49909	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.854243994 CET	80	49909	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.854482889 CET	49909	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.874528885 CET	49909	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.929477930 CET	80	49909	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.929761887 CET	80	49909	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.929850101 CET	80	49909	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.929914951 CET	80	49909	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.929976940 CET	80	49909	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.930016041 CET	49909	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.930037022 CET	80	49909	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.930054903 CET	49909	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.930097103 CET	80	49909	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.930151939 CET	80	49909	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.930161953 CET	49909	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.930201054 CET	80	49909	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:56.930305958 CET	49909	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.941323042 CET	49909	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:56.996335030 CET	80	49909	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.119791031 CET	49910	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.174381971 CET	80	49910	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.174582005 CET	49910	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.216171980 CET	49910	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.272344112 CET	80	49910	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.272603989 CET	80	49910	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.272692919 CET	80	49910	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.272753954 CET	80	49910	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.272815943 CET	80	49910	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.272828102 CET	49910	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.272878885 CET	80	49910	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.272882938 CET	49910	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.272938967 CET	80	49910	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.273004055 CET	49910	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.273045063 CET	80	49910	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.273086071 CET	80	49910	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.273140907 CET	49910	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.274899960 CET	49910	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.330945969 CET	80	49910	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.366358042 CET	49911	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.419969082 CET	80	49911	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.420118093 CET	49911	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.420211077 CET	49911	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.473879099 CET	80	49911	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.474208117 CET	80	49911	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.474272966 CET	80	49911	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.474329948 CET	80	49911	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.474334002 CET	49911	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.474385977 CET	80	49911	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.474442959 CET	49911	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.474445105 CET	80	49911	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.474513054 CET	80	49911	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.474561930 CET	80	49911	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.474571943 CET	49911	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.474603891 CET	80	49911	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.474652052 CET	49911	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.476324081 CET	49911	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.529758930 CET	80	49911	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.573203087 CET	49912	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.628761053 CET	80	49912	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.628910065 CET	49912	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.632174969 CET	49912	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.688369989 CET	80	49912	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.688493013 CET	80	49912	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.688549042 CET	80	49912	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.688597918 CET	80	49912	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.688626051 CET	49912	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.688647032 CET	80	49912	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.688694954 CET	80	49912	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.688711882 CET	49912	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.688743114 CET	80	49912	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.688786030 CET	80	49912	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.688802004 CET	49912	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.688824892 CET	80	49912	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:57.688880920 CET	49912	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.690568924 CET	49912	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:57.747298956 CET	80	49912	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.296603918 CET	49913	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.350260019 CET	80	49913	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.350518942 CET	49913	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.372442961 CET	49913	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.427032948 CET	80	49913	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.427408934 CET	80	49913	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.427464962 CET	80	49913	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.427515984 CET	80	49913	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.427563906 CET	80	49913	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.427614927 CET	80	49913	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.427663088 CET	80	49913	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.427671909 CET	49913	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.427700043 CET	49913	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.427706003 CET	80	49913	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.427722931 CET	49913	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.427736998 CET	80	49913	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.427822113 CET	49913	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.441206932 CET	49913	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.496726036 CET	80	49913	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.603679895 CET	443	49750	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:59.603753090 CET	443	49751	54.197.251.114	192.168.2.3
Jan 30, 2021 12:51:59.603898048 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:59.603909969 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:51:59.614731073 CET	49914	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.667727947 CET	80	49914	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.667922020 CET	49914	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.719146967 CET	49914	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.772304058 CET	80	49914	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.772548914 CET	80	49914	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.772600889 CET	80	49914	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.772650957 CET	80	49914	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.772700071 CET	80	49914	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.772742987 CET	49914	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.772749901 CET	80	49914	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.772799969 CET	49914	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.772819996 CET	80	49914	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.772845030 CET	80	49914	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.772862911 CET	80	49914	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.772933960 CET	49914	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.772979021 CET	49914	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.774863005 CET	49914	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.830102921 CET	80	49914	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.885344982 CET	49915	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.941536903 CET	80	49915	178.79.242.147	192.168.2.3
Jan 30, 2021 12:51:59.941664934 CET	49915	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:51:59.973361969 CET	49915	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.029570103 CET	80	49915	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.030177116 CET	80	49915	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.030245066 CET	80	49915	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.030307055 CET	80	49915	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.030368090 CET	80	49915	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.030430079 CET	80	49915	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.030450106 CET	49915	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.030486107 CET	49915	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.030488968 CET	80	49915	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.030544996 CET	80	49915	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.030560017 CET	49915	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.030596018 CET	80	49915	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.030657053 CET	49915	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.032346964 CET	49915	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.088300943 CET	80	49915	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.152127981 CET	49916	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.204557896 CET	80	49916	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.204684973 CET	49916	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.207834959 CET	49916	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.260253906 CET	80	49916	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.260621071 CET	80	49916	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.260675907 CET	80	49916	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.260725021 CET	80	49916	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.260742903 CET	49916	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.260792017 CET	80	49916	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.260845900 CET	80	49916	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.260857105 CET	49916	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.260905027 CET	80	49916	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.260946989 CET	80	49916	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.260965109 CET	49916	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.261009932 CET	80	49916	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.261064053 CET	49916	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.263436079 CET	49916	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.317802906 CET	80	49916	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.364125967 CET	49917	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.417454958 CET	80	49917	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.417740107 CET	49917	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.430445910 CET	49917	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.485821962 CET	80	49917	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.486484051 CET	80	49917	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.486540079 CET	80	49917	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.486602068 CET	80	49917	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.486656904 CET	80	49917	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.486691952 CET	49917	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.486706972 CET	80	49917	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.486726999 CET	49917	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.486757040 CET	80	49917	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.486799955 CET	80	49917	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.486816883 CET	49917	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.486825943 CET	80	49917	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.486892939 CET	49917	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.515145063 CET	49917	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.570708990 CET	80	49917	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.720381021 CET	49918	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.772742987 CET	80	49918	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.772902966 CET	49918	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.781806946 CET	49918	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.836179018 CET	80	49918	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.836256027 CET	80	49918	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.836311102 CET	80	49918	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.836366892 CET	80	49918	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.836383104 CET	49918	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.836426020 CET	80	49918	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.836483955 CET	49918	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.836493015 CET	80	49918	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.836551905 CET	80	49918	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.836604118 CET	80	49918	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.836608887 CET	49918	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.836646080 CET	80	49918	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:00.836697102 CET	49918	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.863509893 CET	49918	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:00.915919065 CET	80	49918	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.033221006 CET	49919	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.086632013 CET	80	49919	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.086822987 CET	49919	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.086885929 CET	49919	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.142731905 CET	80	49919	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.144591093 CET	80	49919	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.144655943 CET	80	49919	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.144716978 CET	80	49919	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.144778013 CET	80	49919	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.144828081 CET	49919	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.144838095 CET	80	49919	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.144871950 CET	49919	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.144898891 CET	80	49919	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.144953966 CET	80	49919	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.144973993 CET	49919	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.145004988 CET	80	49919	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.145068884 CET	49919	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.153394938 CET	49919	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.209165096 CET	80	49919	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.339168072 CET	49920	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.392715931 CET	80	49920	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.392890930 CET	49920	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.411973000 CET	49920	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.464170933 CET	80	49920	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.464638948 CET	80	49920	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.464699984 CET	80	49920	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.464761972 CET	80	49920	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.464781046 CET	49920	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.464821100 CET	80	49920	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.464880943 CET	80	49920	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.464898109 CET	49920	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.464941978 CET	80	49920	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.464996099 CET	80	49920	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.465033054 CET	49920	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.465043068 CET	80	49920	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.465100050 CET	49920	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.467139959 CET	49920	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.519923925 CET	80	49920	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.634865046 CET	49921	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.689024925 CET	80	49921	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.689254045 CET	49921	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.703351974 CET	49921	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.758220911 CET	80	49921	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.758558035 CET	80	49921	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.758611917 CET	80	49921	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.758661032 CET	80	49921	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.758703947 CET	49921	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.758712053 CET	80	49921	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.758761883 CET	80	49921	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.758775949 CET	49921	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.758810997 CET	80	49921	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.758853912 CET	80	49921	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.758882046 CET	49921	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.758884907 CET	80	49921	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.758950949 CET	49921	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.760642052 CET	49921	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.815821886 CET	80	49921	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.889374971 CET	49922	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.945465088 CET	80	49922	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:01.945662975 CET	49922	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:01.945713043 CET	49922	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.001562119 CET	80	49922	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.001671076 CET	80	49922	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.001729012 CET	80	49922	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.001777887 CET	80	49922	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.001828909 CET	80	49922	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.001852989 CET	49922	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.001878023 CET	80	49922	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.001887083 CET	49922	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.001926899 CET	80	49922	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.001969099 CET	80	49922	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.001987934 CET	49922	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.002079964 CET	80	49922	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.002135038 CET	49922	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.047247887 CET	49922	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.100722075 CET	80	49922	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.215933084 CET	49923	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.272239923 CET	80	49923	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.272424936 CET	49923	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.301947117 CET	49923	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.355551958 CET	80	49923	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.355660915 CET	80	49923	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.355716944 CET	80	49923	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.355770111 CET	80	49923	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.355820894 CET	80	49923	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.355865002 CET	49923	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.355870008 CET	80	49923	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.355909109 CET	49923	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.355923891 CET	80	49923	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.355968952 CET	80	49923	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.355989933 CET	49923	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.356007099 CET	80	49923	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.356062889 CET	49923	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.357774019 CET	49923	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.413685083 CET	80	49923	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.464154005 CET	49924	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.517626047 CET	80	49924	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.517900944 CET	49924	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.543929100 CET	49924	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.598517895 CET	80	49924	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.598926067 CET	80	49924	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.598979950 CET	80	49924	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.599029064 CET	80	49924	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.599078894 CET	80	49924	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.599102974 CET	49924	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.599128008 CET	80	49924	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.599136114 CET	49924	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.599178076 CET	80	49924	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.599220991 CET	80	49924	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.599251032 CET	49924	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.599260092 CET	80	49924	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.599318981 CET	49924	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.601058006 CET	49924	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.655987978 CET	80	49924	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.714423895 CET	49925	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.767896891 CET	80	49925	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.768059015 CET	49925	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.769221067 CET	49925	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.825256109 CET	80	49925	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.825329065 CET	80	49925	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.825381994 CET	80	49925	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.825462103 CET	80	49925	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.825480938 CET	49925	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.825535059 CET	80	49925	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.825584888 CET	80	49925	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.825601101 CET	49925	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.825656891 CET	80	49925	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.825719118 CET	80	49925	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.825736046 CET	49925	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.825786114 CET	80	49925	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.825841904 CET	49925	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.832544088 CET	49925	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.887787104 CET	80	49925	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.942931890 CET	49926	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:02.995469093 CET	80	49926	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:02.995738029 CET	49926	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.027918100 CET	49926	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.082681894 CET	80	49926	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.082770109 CET	80	49926	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.082834959 CET	80	49926	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.082896948 CET	80	49926	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.082961082 CET	80	49926	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.082983971 CET	49926	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.083022118 CET	80	49926	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.083031893 CET	49926	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.083082914 CET	80	49926	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.083138943 CET	80	49926	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.083156109 CET	49926	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.083185911 CET	80	49926	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.083244085 CET	49926	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.084954023 CET	49926	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.137514114 CET	80	49926	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.254209995 CET	49927	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.312513113 CET	80	49927	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.312670946 CET	49927	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.341181040 CET	49927	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.395554066 CET	80	49927	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.395637035 CET	80	49927	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.395689011 CET	80	49927	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.395740032 CET	80	49927	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.395765066 CET	49927	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.395787954 CET	80	49927	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.395839930 CET	80	49927	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.395848036 CET	49927	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.395888090 CET	80	49927	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.395930052 CET	80	49927	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.395950079 CET	49927	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.395966053 CET	80	49927	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.396028042 CET	49927	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.397742987 CET	49927	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.453422070 CET	80	49927	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.520025015 CET	49928	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.576306105 CET	80	49928	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.576520920 CET	49928	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.582851887 CET	49928	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.638196945 CET	80	49928	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.638638020 CET	80	49928	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.638710976 CET	80	49928	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.638766050 CET	80	49928	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.638817072 CET	80	49928	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.638844967 CET	49928	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.638865948 CET	80	49928	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.638885975 CET	49928	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.638916016 CET	80	49928	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.638958931 CET	80	49928	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.638979912 CET	49928	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.638994932 CET	80	49928	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.639045954 CET	49928	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.641112089 CET	49928	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.695069075 CET	80	49928	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.759931087 CET	49929	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.812155962 CET	80	49929	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.812282085 CET	49929	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.818026066 CET	49929	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.870132923 CET	80	49929	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.870570898 CET	80	49929	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.870625973 CET	80	49929	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.870676994 CET	80	49929	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.870726109 CET	80	49929	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.870745897 CET	49929	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.870790005 CET	49929	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.870814085 CET	80	49929	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.870865107 CET	80	49929	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.870908022 CET	80	49929	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.870923996 CET	49929	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.870969057 CET	80	49929	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.871025085 CET	49929	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.872776031 CET	49929	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:03.925086021 CET	80	49929	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:03.934557915 CET	443	49806	3.214.78.220	192.168.2.3
Jan 30, 2021 12:52:03.934612036 CET	443	49805	3.214.78.220	192.168.2.3
Jan 30, 2021 12:52:03.934715033 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:52:03.934782982 CET	49806	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:52:03.960478067 CET	49930	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.013619900 CET	80	49930	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.013887882 CET	49930	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.013942003 CET	49930	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.066978931 CET	80	49930	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.067305088 CET	80	49930	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.067364931 CET	80	49930	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.067415953 CET	80	49930	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.067465067 CET	80	49930	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.067514896 CET	80	49930	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.067563057 CET	80	49930	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.067564011 CET	49930	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.067605019 CET	49930	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.067605972 CET	80	49930	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.067610979 CET	49930	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.067645073 CET	80	49930	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.067707062 CET	49930	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.069483995 CET	49930	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.125334978 CET	80	49930	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.213037968 CET	49931	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.268192053 CET	80	49931	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.268353939 CET	49931	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.281050920 CET	49931	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.336132050 CET	80	49931	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.336544037 CET	80	49931	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.336601019 CET	80	49931	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.336651087 CET	80	49931	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.336699009 CET	80	49931	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.336736917 CET	49931	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.336749077 CET	80	49931	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.336762905 CET	49931	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.336797953 CET	80	49931	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.336842060 CET	80	49931	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.336865902 CET	49931	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.336880922 CET	80	49931	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.336940050 CET	49931	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.338716984 CET	49931	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.393609047 CET	80	49931	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.445271015 CET	49932	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.500518084 CET	80	49932	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.500853062 CET	49932	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.532146931 CET	49932	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.587114096 CET	80	49932	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.587172985 CET	80	49932	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.587280035 CET	80	49932	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.587332010 CET	80	49932	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.587361097 CET	49932	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.587380886 CET	80	49932	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.587430000 CET	80	49932	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.587446928 CET	49932	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.587482929 CET	80	49932	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.587526083 CET	80	49932	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.587542057 CET	49932	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.587558985 CET	80	49932	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.587619066 CET	49932	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.589296103 CET	49932	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.612216949 CET	443	49750	54.197.251.114	192.168.2.3
Jan 30, 2021 12:52:04.612286091 CET	443	49751	54.197.251.114	192.168.2.3
Jan 30, 2021 12:52:04.612333059 CET	49750	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:52:04.612425089 CET	49751	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:52:04.647316933 CET	80	49932	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.711302042 CET	49933	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.764655113 CET	80	49933	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.764745951 CET	49933	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.789177895 CET	49933	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.842581987 CET	80	49933	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.842871904 CET	80	49933	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.842927933 CET	80	49933	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.842978954 CET	80	49933	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.843010902 CET	49933	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.843033075 CET	80	49933	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.843081951 CET	80	49933	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.843096972 CET	49933	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.843131065 CET	80	49933	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.843173981 CET	80	49933	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.843188047 CET	49933	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.843209982 CET	80	49933	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:04.843270063 CET	49933	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.959959030 CET	49933	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:04.960556030 CET	49934	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.015204906 CET	80	49933	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.018778086 CET	80	49934	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.019021034 CET	49934	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.020829916 CET	49934	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.076944113 CET	80	49934	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.077281952 CET	80	49934	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.077347994 CET	80	49934	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.077431917 CET	80	49934	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.077438116 CET	49934	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.077493906 CET	80	49934	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.077553034 CET	80	49934	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.077562094 CET	49934	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.077613115 CET	80	49934	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.077667952 CET	80	49934	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.077677011 CET	49934	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.077713013 CET	80	49934	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.077774048 CET	49934	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.087862015 CET	49934	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.144238949 CET	80	49934	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.266308069 CET	49935	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.320355892 CET	80	49935	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.320542097 CET	49935	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.327169895 CET	49935	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.381191015 CET	80	49935	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.381515980 CET	80	49935	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.381562948 CET	80	49935	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.381607056 CET	80	49935	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.381652117 CET	80	49935	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.381652117 CET	49935	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.381695986 CET	80	49935	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.381733894 CET	80	49935	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.381762028 CET	49935	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.381769896 CET	80	49935	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.381793022 CET	80	49935	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.381804943 CET	49935	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.381850958 CET	49935	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.383681059 CET	49935	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.431233883 CET	80	49760	98.143.146.7	192.168.2.3
Jan 30, 2021 12:52:05.431377888 CET	49760	80	192.168.2.3	98.143.146.7
Jan 30, 2021 12:52:05.439271927 CET	80	49935	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.474117994 CET	49936	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.529639006 CET	80	49936	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.529784918 CET	49936	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.542546988 CET	49936	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.597799063 CET	80	49936	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.597872019 CET	80	49936	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.597923040 CET	80	49936	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.597971916 CET	80	49936	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.598017931 CET	49936	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.598045111 CET	80	49936	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.598098993 CET	80	49936	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.598109961 CET	49936	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.598156929 CET	80	49936	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.598198891 CET	80	49936	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.598213911 CET	49936	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.598259926 CET	80	49936	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:05.598311901 CET	49936	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.657198906 CET	49936	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:05.710556984 CET	80	49936	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.002103090 CET	49937	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.055560112 CET	80	49937	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.055768013 CET	49937	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.061950922 CET	49937	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.115050077 CET	80	49937	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.115204096 CET	80	49937	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.115258932 CET	80	49937	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.115315914 CET	80	49937	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.115375042 CET	80	49937	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.115391016 CET	49937	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.115426064 CET	80	49937	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.115446091 CET	49937	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.115484953 CET	80	49937	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.115528107 CET	80	49937	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.115555048 CET	49937	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.115576982 CET	80	49937	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.115638018 CET	49937	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.117296934 CET	49937	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.170556068 CET	80	49937	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.214715958 CET	49938	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.270339012 CET	80	49938	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.270509958 CET	49938	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.270586014 CET	49938	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.322925091 CET	80	49938	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.323189974 CET	80	49938	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.323250055 CET	80	49938	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.323299885 CET	80	49938	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.323332071 CET	49938	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.323350906 CET	80	49938	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.323400021 CET	80	49938	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.323412895 CET	49938	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.323450089 CET	80	49938	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.323492050 CET	80	49938	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.323512077 CET	49938	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.323523998 CET	80	49938	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.323575020 CET	49938	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.325442076 CET	49938	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.377762079 CET	80	49938	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.445780993 CET	49939	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.500360966 CET	80	49939	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.500622988 CET	49939	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.509459972 CET	49939	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.562700987 CET	80	49939	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.563169003 CET	80	49939	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.563219070 CET	80	49939	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.563261986 CET	80	49939	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.563333035 CET	49939	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.563342094 CET	80	49939	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.563394070 CET	80	49939	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.563430071 CET	49939	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.563446999 CET	80	49939	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.563491106 CET	80	49939	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.563529015 CET	80	49939	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.563529968 CET	49939	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.563602924 CET	49939	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.734205961 CET	49939	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.787549019 CET	80	49939	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.807765007 CET	49940	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.862015009 CET	80	49940	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.862124920 CET	49940	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.862189054 CET	49940	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.919141054 CET	80	49940	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.919564009 CET	80	49940	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.919617891 CET	80	49940	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.919667959 CET	80	49940	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.919712067 CET	49940	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.919718981 CET	80	49940	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.919770002 CET	80	49940	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.919785023 CET	49940	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.919820070 CET	80	49940	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.919862032 CET	80	49940	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.919881105 CET	49940	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.919903040 CET	80	49940	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:06.919962883 CET	49940	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.932421923 CET	49940	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:06.986932039 CET	80	49940	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.084585905 CET	49941	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.140284061 CET	80	49941	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.140413046 CET	49941	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.143552065 CET	49941	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.196738958 CET	80	49941	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.197067976 CET	80	49941	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.197132111 CET	80	49941	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.197195053 CET	80	49941	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.197251081 CET	49941	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.197256088 CET	80	49941	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.197314978 CET	80	49941	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.197340965 CET	49941	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.197375059 CET	80	49941	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.197439909 CET	49941	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.197459936 CET	80	49941	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.197500944 CET	80	49941	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.197577000 CET	49941	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.612181902 CET	49941	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.668051004 CET	80	49941	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.786541939 CET	49942	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.840004921 CET	80	49942	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.840256929 CET	49942	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.846081972 CET	49942	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.900912046 CET	80	49942	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.901212931 CET	80	49942	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.901256084 CET	80	49942	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.901293993 CET	80	49942	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.901329994 CET	80	49942	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.901357889 CET	49942	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.901367903 CET	80	49942	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.901402950 CET	49942	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.901437998 CET	80	49942	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.901473045 CET	80	49942	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.901509047 CET	49942	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.901551962 CET	80	49942	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:07.901617050 CET	49942	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.906658888 CET	49942	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:07.962578058 CET	80	49942	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.044763088 CET	49943	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.097084999 CET	80	49943	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.097246885 CET	49943	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.097337008 CET	49943	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.149597883 CET	80	49943	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.149858952 CET	80	49943	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.149902105 CET	80	49943	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.149938107 CET	80	49943	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.149976015 CET	80	49943	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.149980068 CET	49943	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.150013924 CET	80	49943	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.150033951 CET	49943	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.150049925 CET	80	49943	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.150082111 CET	80	49943	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.150108099 CET	80	49943	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.150120020 CET	49943	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.150168896 CET	49943	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.151782990 CET	49943	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.206242085 CET	80	49943	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.252106905 CET	49944	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.310369968 CET	80	49944	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.310535908 CET	49944	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.313731909 CET	49944	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.372159004 CET	80	49944	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.372443914 CET	80	49944	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.372464895 CET	80	49944	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.372486115 CET	80	49944	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.372507095 CET	80	49944	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.372531891 CET	80	49944	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.372555971 CET	80	49944	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.372584105 CET	80	49944	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.372582912 CET	49944	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.372598886 CET	80	49944	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.372669935 CET	49944	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.372678041 CET	49944	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.372682095 CET	49944	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.508080959 CET	49944	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.529892921 CET	49945	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.567972898 CET	80	49944	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.584330082 CET	80	49945	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.584444046 CET	49945	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.584533930 CET	49945	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.637938976 CET	80	49945	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.638238907 CET	80	49945	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.638283014 CET	80	49945	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.638320923 CET	80	49945	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.638367891 CET	80	49945	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.638408899 CET	80	49945	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.638415098 CET	49945	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.638439894 CET	49945	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.638446093 CET	80	49945	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.638477087 CET	80	49945	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.638501883 CET	80	49945	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.638514996 CET	49945	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.638561010 CET	49945	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.641748905 CET	49945	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.694991112 CET	80	49945	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.818417072 CET	49946	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.870692968 CET	80	49946	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.870803118 CET	49946	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.870883942 CET	49946	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.900962114 CET	49817	80	192.168.2.3	178.79.242.181
Jan 30, 2021 12:52:08.901771069 CET	49824	443	192.168.2.3	99.86.154.93
Jan 30, 2021 12:52:08.923320055 CET	80	49946	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.923374891 CET	80	49946	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.923413038 CET	80	49946	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.923459053 CET	80	49946	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.923501015 CET	80	49946	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.923532009 CET	49946	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.923538923 CET	80	49946	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.923571110 CET	49946	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.923593998 CET	80	49946	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.923626900 CET	80	49946	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.923650980 CET	80	49946	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:08.923667908 CET	49946	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.923716068 CET	49946	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.925483942 CET	49946	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:08.934638023 CET	443	49806	3.214.78.220	192.168.2.3
Jan 30, 2021 12:52:08.934676886 CET	443	49805	3.214.78.220	192.168.2.3
Jan 30, 2021 12:52:08.934777975 CET	49806	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:52:08.936288118 CET	49805	443	192.168.2.3	3.214.78.220
Jan 30, 2021 12:52:08.977945089 CET	80	49946	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.055851936 CET	49947	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.111650944 CET	80	49947	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.111819983 CET	49947	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.121633053 CET	49947	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.176621914 CET	80	49947	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.176680088 CET	80	49947	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.176722050 CET	80	49947	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.176758051 CET	80	49947	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.176794052 CET	80	49947	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.176832914 CET	80	49947	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.176846027 CET	49947	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.176878929 CET	49947	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.176879883 CET	80	49947	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.176918030 CET	80	49947	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.176934004 CET	49947	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.177109003 CET	80	49947	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.177162886 CET	49947	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.178713083 CET	49947	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.233170033 CET	80	49947	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.293703079 CET	49948	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.348783016 CET	80	49948	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.348963022 CET	49948	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.349669933 CET	49948	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.402962923 CET	80	49948	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.403017044 CET	80	49948	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.403048992 CET	80	49948	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.403079033 CET	80	49948	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.403119087 CET	80	49948	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.403156996 CET	80	49948	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.403193951 CET	80	49948	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.403206110 CET	49948	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.403235912 CET	80	49948	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.403265953 CET	80	49948	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.403287888 CET	49948	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.403326035 CET	49948	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.440354109 CET	49948	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.495724916 CET	80	49948	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.553603888 CET	49950	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.609992027 CET	80	49950	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.610129118 CET	49950	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.642096043 CET	49950	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.699870110 CET	80	49950	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.700176001 CET	80	49950	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.700217962 CET	80	49950	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.700254917 CET	80	49950	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.700293064 CET	80	49950	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.700329065 CET	80	49950	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.700360060 CET	49950	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.700373888 CET	49950	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.700380087 CET	80	49950	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.700412035 CET	80	49950	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.700434923 CET	49950	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.700438976 CET	80	49950	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.700499058 CET	49950	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.705868006 CET	49950	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.763494968 CET	80	49950	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.844249010 CET	49951	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.897722960 CET	80	49951	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.897905111 CET	49951	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.897975922 CET	49951	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.951129913 CET	80	49951	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.951292992 CET	80	49951	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.951332092 CET	80	49951	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.951373100 CET	80	49951	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.951425076 CET	80	49951	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.951464891 CET	80	49951	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.951478958 CET	49951	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.951510906 CET	80	49951	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.951520920 CET	49951	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.951544046 CET	80	49951	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.951584101 CET	49951	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:09.951586008 CET	80	49951	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:09.951662064 CET	49951	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.084359884 CET	49951	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.116355896 CET	49952	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.140175104 CET	80	49951	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.173088074 CET	80	49952	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.173290968 CET	49952	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.173362017 CET	49952	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.228327990 CET	80	49952	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.228379011 CET	80	49952	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.228429079 CET	80	49952	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.228480101 CET	80	49952	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.228539944 CET	80	49952	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.228569984 CET	49952	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.228579044 CET	80	49952	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.228617907 CET	49952	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.228632927 CET	80	49952	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.228667021 CET	80	49952	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.228701115 CET	80	49952	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.228710890 CET	49952	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.228774071 CET	49952	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.230413914 CET	49952	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.285659075 CET	80	49952	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.442491055 CET	49953	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.497307062 CET	80	49953	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.497421980 CET	49953	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.497610092 CET	49953	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.550251961 CET	80	49953	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.550322056 CET	80	49953	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.550364017 CET	80	49953	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.550400019 CET	80	49953	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.550441980 CET	49953	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.550458908 CET	80	49953	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.550498009 CET	80	49953	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.550517082 CET	49953	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.550535917 CET	80	49953	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.550568104 CET	80	49953	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.550592899 CET	80	49953	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.550596952 CET	49953	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.550652027 CET	49953	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.552328110 CET	49953	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.604789019 CET	80	49953	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.666985989 CET	49954	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.722337008 CET	80	49954	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.722485065 CET	49954	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.726423979 CET	49954	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.783091068 CET	80	49954	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.783669949 CET	80	49954	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.783716917 CET	80	49954	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.783754110 CET	80	49954	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.783792019 CET	80	49954	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.783829927 CET	80	49954	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.783858061 CET	49954	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.783866882 CET	80	49954	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.783888102 CET	49954	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.783906937 CET	80	49954	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.783936977 CET	80	49954	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.783942938 CET	49954	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.783998966 CET	49954	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.785840988 CET	49954	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.843113899 CET	80	49954	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.898526907 CET	49955	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.952179909 CET	80	49955	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:10.952301979 CET	49955	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:10.973145008 CET	49955	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.026483059 CET	80	49955	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.026545048 CET	80	49955	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.026585102 CET	80	49955	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.026623011 CET	80	49955	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.026635885 CET	49955	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.026659012 CET	80	49955	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.026705027 CET	80	49955	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.026710987 CET	49955	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.026746988 CET	80	49955	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.026777029 CET	80	49955	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.026803017 CET	49955	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.026931047 CET	80	49955	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.026985884 CET	49955	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.028680086 CET	49955	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.083847046 CET	80	49955	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.174830914 CET	49956	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.209876060 CET	49957	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:11.230026960 CET	80	49956	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.230187893 CET	49956	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.230237961 CET	49956	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.283493996 CET	80	49956	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.283551931 CET	80	49956	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.283591032 CET	80	49956	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.283628941 CET	80	49956	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.283667088 CET	80	49956	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.283714056 CET	80	49956	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.283727884 CET	49956	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.283756018 CET	80	49956	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.283756971 CET	49956	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.283786058 CET	80	49956	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.283812046 CET	80	49956	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.283827066 CET	49956	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.283874035 CET	49956	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.285542011 CET	49956	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.336083889 CET	80	49957	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:11.336363077 CET	49957	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:11.338665962 CET	80	49956	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.404149055 CET	49957	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:11.443228960 CET	49958	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.496567965 CET	80	49958	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.496787071 CET	49958	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.496876955 CET	49958	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.530040979 CET	80	49957	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:11.531141043 CET	80	49957	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:11.533516884 CET	49957	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:11.552310944 CET	80	49958	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.552365065 CET	80	49958	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.552405119 CET	80	49958	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.552440882 CET	80	49958	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.552475929 CET	49958	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.552479029 CET	80	49958	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.552519083 CET	80	49958	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.552541018 CET	49958	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.552566051 CET	80	49958	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.552602053 CET	80	49958	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.552627087 CET	80	49958	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.552643061 CET	49958	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.552696943 CET	49958	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.554315090 CET	49958	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.601373911 CET	443	49831	54.197.251.114	192.168.2.3
Jan 30, 2021 12:52:11.601569891 CET	443	49833	54.197.251.114	192.168.2.3
Jan 30, 2021 12:52:11.601608992 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:52:11.601679087 CET	49833	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:52:11.607599974 CET	80	49958	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.659674883 CET	80	49957	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:11.659966946 CET	49957	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:11.664045095 CET	49959	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.720724106 CET	80	49959	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.720851898 CET	49959	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.720997095 CET	49959	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.777329922 CET	80	49959	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.777688026 CET	80	49959	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.777731895 CET	80	49959	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.777769089 CET	80	49959	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.777805090 CET	80	49959	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.777805090 CET	49959	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.777843952 CET	80	49959	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.777863979 CET	49959	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.777890921 CET	80	49959	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.777926922 CET	80	49959	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.777946949 CET	49959	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.777951002 CET	80	49959	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.778012991 CET	49959	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.779927969 CET	49959	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:11.838237047 CET	80	49959	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:11.955800056 CET	49960	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.009071112 CET	80	49960	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.009170055 CET	49960	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.009310961 CET	49960	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.062391043 CET	80	49960	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.062448978 CET	80	49960	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.062485933 CET	80	49960	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.062524080 CET	80	49960	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.062552929 CET	49960	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.062566042 CET	80	49960	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.062602997 CET	80	49960	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.062623978 CET	49960	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.062639952 CET	80	49960	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.062669039 CET	80	49960	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.062695026 CET	49960	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.062706947 CET	80	49960	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.062772989 CET	49960	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.064666986 CET	49960	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.118771076 CET	80	49960	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.190571070 CET	49961	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.246002913 CET	80	49961	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.246170998 CET	49961	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.246238947 CET	49961	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.299513102 CET	80	49961	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.299577951 CET	80	49961	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.299619913 CET	80	49961	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.299655914 CET	80	49961	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.299704075 CET	80	49961	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.299745083 CET	80	49961	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.299760103 CET	49961	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.299782038 CET	80	49961	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.299801111 CET	49961	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.299815893 CET	80	49961	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.299841881 CET	49961	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.299844027 CET	80	49961	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.299906015 CET	49961	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.301625013 CET	49961	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.354935884 CET	80	49961	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.416199923 CET	49962	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.469676018 CET	80	49962	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.469888926 CET	49962	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.475876093 CET	49962	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.529300928 CET	80	49962	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.529444933 CET	80	49962	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.529498100 CET	80	49962	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.529540062 CET	80	49962	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.529553890 CET	49962	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.529603004 CET	80	49962	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.529649019 CET	80	49962	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.529660940 CET	49962	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.529689074 CET	80	49962	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.529721975 CET	80	49962	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.529747009 CET	80	49962	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.529756069 CET	49962	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.529798031 CET	49962	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.531461000 CET	49962	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.586044073 CET	80	49962	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.656976938 CET	49963	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.711359024 CET	80	49963	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.711481094 CET	49963	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.711596012 CET	49963	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.767446995 CET	80	49963	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.767945051 CET	80	49963	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.767987967 CET	80	49963	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.768023968 CET	80	49963	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.768062115 CET	80	49963	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.768066883 CET	49963	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.768100023 CET	80	49963	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.768129110 CET	49963	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.768137932 CET	80	49963	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.768171072 CET	80	49963	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.768196106 CET	80	49963	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.768204927 CET	49963	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.768254995 CET	49963	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.769934893 CET	49963	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.825920105 CET	80	49963	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.868089914 CET	49964	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.923543930 CET	80	49964	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.923739910 CET	49964	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.923811913 CET	49964	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.978964090 CET	80	49964	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.979017973 CET	80	49964	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.979058981 CET	80	49964	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.979094982 CET	80	49964	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.979130983 CET	80	49964	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.979176998 CET	80	49964	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.979218960 CET	80	49964	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.979217052 CET	49964	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.979252100 CET	80	49964	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.979259014 CET	49964	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.979276896 CET	49964	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.979279041 CET	80	49964	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:12.979351044 CET	49964	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:12.981117010 CET	49964	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.037992001 CET	80	49964	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.103595018 CET	49965	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.156065941 CET	80	49965	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.156209946 CET	49965	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.197774887 CET	49965	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.251537085 CET	80	49965	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.251908064 CET	80	49965	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.251950979 CET	80	49965	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.251988888 CET	80	49965	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.252027035 CET	80	49965	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.252034903 CET	49965	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.252065897 CET	80	49965	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.252085924 CET	49965	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.252103090 CET	80	49965	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.252134085 CET	80	49965	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.252154112 CET	49965	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.252159119 CET	80	49965	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.252216101 CET	49965	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.275341034 CET	49965	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.327896118 CET	80	49965	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.431976080 CET	49966	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.489178896 CET	80	49966	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.489305019 CET	49966	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.489425898 CET	49966	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.547748089 CET	80	49966	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.548053026 CET	80	49966	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.548094988 CET	80	49966	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.548130989 CET	80	49966	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.548167944 CET	80	49966	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.548207045 CET	80	49966	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.548216105 CET	49966	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.548247099 CET	80	49966	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.548249006 CET	49966	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.548280001 CET	80	49966	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.548305988 CET	80	49966	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.548306942 CET	49966	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.548358917 CET	49966	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.703314066 CET	49966	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.754904032 CET	49967	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.760571003 CET	80	49966	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.812242985 CET	80	49967	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.812340021 CET	49967	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.812453032 CET	49967	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.869509935 CET	80	49967	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.869811058 CET	80	49967	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.869864941 CET	80	49967	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.869903088 CET	80	49967	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.869935989 CET	49967	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.869941950 CET	80	49967	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.869981050 CET	80	49967	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.870007992 CET	49967	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.870017052 CET	80	49967	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.870048046 CET	80	49967	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.870071888 CET	80	49967	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.870074987 CET	49967	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.870126963 CET	49967	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.871824026 CET	49967	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:13.928975105 CET	80	49967	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:13.996452093 CET	49968	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.048660040 CET	80	49968	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.048871040 CET	49968	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.048932076 CET	49968	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.102503061 CET	80	49968	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.102859020 CET	80	49968	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.102910042 CET	80	49968	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.102952003 CET	80	49968	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.103002071 CET	80	49968	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.103046894 CET	49968	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.103054047 CET	80	49968	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.103091955 CET	49968	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.103096008 CET	80	49968	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.103127956 CET	80	49968	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.103153944 CET	80	49968	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.103158951 CET	49968	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.103209019 CET	49968	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.104890108 CET	49968	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.157026052 CET	80	49968	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.184267998 CET	49969	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.240444899 CET	80	49969	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.240586042 CET	49969	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.270637989 CET	49969	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.329457045 CET	80	49969	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.329793930 CET	80	49969	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.329835892 CET	80	49969	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.329871893 CET	80	49969	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.329909086 CET	80	49969	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.329938889 CET	49969	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.329965115 CET	80	49969	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.329973936 CET	49969	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.330020905 CET	80	49969	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.330055952 CET	80	49969	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.330087900 CET	80	49969	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:14.330087900 CET	49969	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.330148935 CET	49969	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.347347975 CET	49969	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:14.403558016 CET	80	49969	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.299971104 CET	49970	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.354348898 CET	80	49970	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.354527950 CET	49970	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.361068010 CET	49970	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.417608976 CET	80	49970	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.417867899 CET	80	49970	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.417892933 CET	80	49970	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.417918921 CET	80	49970	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.417943001 CET	80	49970	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.417965889 CET	80	49970	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.417979002 CET	49970	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.417989969 CET	80	49970	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.418004990 CET	80	49970	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.418020010 CET	49970	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.418021917 CET	80	49970	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.418039083 CET	49970	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.418082952 CET	49970	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.419985056 CET	49970	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.474174976 CET	80	49970	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.596108913 CET	49971	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.601632118 CET	443	49836	54.197.251.114	192.168.2.3
Jan 30, 2021 12:52:16.601908922 CET	49836	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:52:16.601995945 CET	443	49835	54.197.251.114	192.168.2.3
Jan 30, 2021 12:52:16.602072954 CET	49835	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:52:16.608573914 CET	443	49831	54.197.251.114	192.168.2.3
Jan 30, 2021 12:52:16.608702898 CET	49831	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:52:16.608876944 CET	443	49833	54.197.251.114	192.168.2.3
Jan 30, 2021 12:52:16.608947039 CET	49833	443	192.168.2.3	54.197.251.114
Jan 30, 2021 12:52:16.649585009 CET	80	49971	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.649801970 CET	49971	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.649857044 CET	49971	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.707401991 CET	80	49971	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.707475901 CET	80	49971	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.707547903 CET	80	49971	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.707631111 CET	80	49971	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.707648039 CET	49971	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.707688093 CET	80	49971	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.707748890 CET	49971	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.707757950 CET	80	49971	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.707825899 CET	80	49971	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.707873106 CET	80	49971	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.707901955 CET	49971	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.707909107 CET	80	49971	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.707978010 CET	49971	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.711126089 CET	49971	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.764710903 CET	80	49971	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.864550114 CET	49972	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.918981075 CET	80	49972	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.919121027 CET	49972	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.923561096 CET	49972	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.976141930 CET	80	49972	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.976197958 CET	80	49972	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.976237059 CET	80	49972	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.976353884 CET	49972	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.976438999 CET	80	49972	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.976536036 CET	80	49972	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.976573944 CET	80	49972	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.976609945 CET	80	49972	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.976624966 CET	49972	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.976639986 CET	80	49972	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.976675987 CET	80	49972	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:16.976702929 CET	49972	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.976763964 CET	49972	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:16.978465080 CET	49972	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.030734062 CET	80	49972	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.105106115 CET	49973	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.157532930 CET	80	49973	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.157769918 CET	49973	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.157953978 CET	49973	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.210833073 CET	80	49973	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.210856915 CET	80	49973	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.210874081 CET	80	49973	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.210891008 CET	80	49973	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.210902929 CET	80	49973	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.210922003 CET	80	49973	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.210939884 CET	80	49973	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.210949898 CET	80	49973	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.210957050 CET	80	49973	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.210988045 CET	49973	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.211025953 CET	49973	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.214586020 CET	49973	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.267013073 CET	80	49973	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.355509996 CET	49974	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.412921906 CET	80	49974	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.413022041 CET	49974	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.413475037 CET	49974	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.470308065 CET	80	49974	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.470726013 CET	80	49974	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.470773935 CET	80	49974	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.470812082 CET	80	49974	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.470849037 CET	80	49974	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.470885038 CET	80	49974	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.470901966 CET	49974	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.470921040 CET	80	49974	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.470933914 CET	49974	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.470952988 CET	80	49974	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.470978975 CET	80	49974	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.470984936 CET	49974	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.471045017 CET	49974	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.618206024 CET	49974	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.674503088 CET	80	49974	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.687470913 CET	49975	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.742594004 CET	80	49975	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.742883921 CET	49975	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.742971897 CET	49975	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.798089981 CET	80	49975	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.798146963 CET	80	49975	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.798185110 CET	80	49975	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.798224926 CET	80	49975	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.798263073 CET	80	49975	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.798261881 CET	49975	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.798300982 CET	80	49975	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.798327923 CET	49975	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.798340082 CET	80	49975	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.798371077 CET	80	49975	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.798399925 CET	49975	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.798404932 CET	80	49975	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.798460960 CET	49975	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.800240040 CET	49975	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:17.852600098 CET	80	49975	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:17.950164080 CET	49976	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.004492998 CET	80	49976	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.004759073 CET	49976	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.013123989 CET	49976	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.066905975 CET	80	49976	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.067179918 CET	80	49976	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.067228079 CET	80	49976	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.067266941 CET	80	49976	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.067303896 CET	80	49976	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.067341089 CET	80	49976	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.067368984 CET	49976	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.067378044 CET	80	49976	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.067383051 CET	49976	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.067420006 CET	80	49976	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.067444086 CET	49976	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.067451000 CET	80	49976	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.067508936 CET	49976	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.069266081 CET	49976	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.126805067 CET	80	49976	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.219373941 CET	49977	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.273484945 CET	80	49977	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.273757935 CET	49977	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.273866892 CET	49977	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.329860926 CET	80	49977	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.329917908 CET	80	49977	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.329958916 CET	80	49977	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.329996109 CET	80	49977	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.330033064 CET	80	49977	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.330070019 CET	80	49977	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.330121994 CET	49977	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.330138922 CET	80	49977	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.330162048 CET	49977	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.330176115 CET	80	49977	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.330200911 CET	80	49977	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.330202103 CET	49977	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.330332994 CET	49977	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.332042933 CET	49977	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.385230064 CET	80	49977	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.474893093 CET	49978	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.530504942 CET	80	49978	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.530632019 CET	49978	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.543050051 CET	49978	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.599221945 CET	80	49978	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.599277020 CET	80	49978	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.599323034 CET	80	49978	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.599364042 CET	80	49978	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.599406958 CET	80	49978	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.599448919 CET	80	49978	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.599463940 CET	49978	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.599495888 CET	80	49978	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.599502087 CET	49978	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.599534035 CET	80	49978	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.599559069 CET	49978	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.599561930 CET	80	49978	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.599621058 CET	49978	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.790800095 CET	49978	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.817090034 CET	49979	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.844402075 CET	80	49978	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.870347023 CET	80	49979	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.870465994 CET	49979	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.870716095 CET	49979	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.923800945 CET	80	49979	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.924109936 CET	80	49979	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.924156904 CET	80	49979	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.924195051 CET	80	49979	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.924232006 CET	80	49979	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.924266100 CET	49979	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.924269915 CET	80	49979	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.924294949 CET	49979	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.924307108 CET	80	49979	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.924348116 CET	80	49979	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.924376965 CET	80	49979	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:18.924379110 CET	49979	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.924442053 CET	49979	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:18.974088907 CET	49979	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.027424097 CET	80	49979	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.222039938 CET	49980	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.274650097 CET	80	49980	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.274842024 CET	49980	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.274902105 CET	49980	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.327347040 CET	80	49980	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.327657938 CET	80	49980	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.327701092 CET	80	49980	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.327739000 CET	80	49980	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.327780008 CET	80	49980	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.327817917 CET	80	49980	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.327853918 CET	80	49980	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.327851057 CET	49980	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.327887058 CET	80	49980	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.327893019 CET	49980	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.327898979 CET	49980	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.327914953 CET	80	49980	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.327980042 CET	49980	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.329690933 CET	49980	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.384711027 CET	80	49980	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.481246948 CET	49981	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.534362078 CET	80	49981	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.534595966 CET	49981	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.586082935 CET	49981	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.639224052 CET	80	49981	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.639318943 CET	80	49981	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.639359951 CET	80	49981	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.639406919 CET	80	49981	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.639451027 CET	80	49981	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.639460087 CET	49981	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.639487982 CET	80	49981	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.639520884 CET	49981	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.639528036 CET	80	49981	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.639559031 CET	80	49981	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.639581919 CET	80	49981	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.639585018 CET	49981	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.639642000 CET	49981	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.792987108 CET	49981	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.807631969 CET	49982	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:19.845374107 CET	49983	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.846045971 CET	80	49981	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.897675037 CET	80	49983	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.904130936 CET	49983	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.913203001 CET	49983	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.933659077 CET	80	49982	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:19.934243917 CET	49982	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:19.934449911 CET	49982	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:19.967271090 CET	80	49983	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.967669010 CET	80	49983	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.967711926 CET	80	49983	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.967749119 CET	80	49983	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.967786074 CET	80	49983	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.967823029 CET	80	49983	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.967869997 CET	80	49983	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.967904091 CET	80	49983	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.967930079 CET	80	49983	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:19.979335070 CET	49983	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:19.981578112 CET	49983	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.034020901 CET	80	49983	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.060415983 CET	80	49982	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:20.061369896 CET	80	49982	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:20.061434031 CET	80	49982	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:20.066570044 CET	49982	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:20.107363939 CET	49982	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:20.113902092 CET	49984	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.170391083 CET	80	49984	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.170636892 CET	49984	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.181868076 CET	49985	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:20.186567068 CET	49984	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.235913038 CET	80	49982	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:20.240818977 CET	80	49984	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.240874052 CET	80	49984	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.240912914 CET	80	49984	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.240948915 CET	80	49984	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.240988016 CET	80	49984	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.241025925 CET	80	49984	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.241071939 CET	80	49984	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.241107941 CET	80	49984	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.241132021 CET	80	49984	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.242530107 CET	49984	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.244915962 CET	49984	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.299365997 CET	80	49984	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.310290098 CET	80	49985	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:20.311188936 CET	49985	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:20.360281944 CET	49985	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:20.396642923 CET	49986	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.454821110 CET	80	49986	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.455058098 CET	49986	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.480154037 CET	49986	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.486358881 CET	80	49985	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:20.487658978 CET	80	49985	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:20.487703085 CET	80	49985	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:20.499603033 CET	49985	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:20.499969959 CET	49985	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:20.537673950 CET	80	49986	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.537727118 CET	80	49986	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.537765980 CET	80	49986	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.537805080 CET	80	49986	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.537844896 CET	80	49986	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.537893057 CET	80	49986	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.537935972 CET	80	49986	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.537966967 CET	80	49986	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.537993908 CET	80	49986	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.549887896 CET	49986	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.566263914 CET	49987	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:20.625982046 CET	80	49985	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:20.694034100 CET	80	49987	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:20.699618101 CET	49987	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:20.703453064 CET	49987	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:20.707577944 CET	49986	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.764910936 CET	80	49986	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.773978949 CET	49988	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.830360889 CET	80	49988	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.831052065 CET	80	49987	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:20.831512928 CET	80	49987	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:20.831609964 CET	80	49987	50.17.220.153	192.168.2.3
Jan 30, 2021 12:52:20.838062048 CET	49988	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.838073015 CET	49987	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:20.838413954 CET	49987	80	192.168.2.3	50.17.220.153
Jan 30, 2021 12:52:20.842133045 CET	49988	80	192.168.2.3	178.79.242.147
Jan 30, 2021 12:52:20.895925045 CET	80	49988	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.896014929 CET	80	49988	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.896054983 CET	80	49988	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.896101952 CET	80	49988	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.896143913 CET	80	49988	178.79.242.147	192.168.2.3
Jan 30, 2021 12:52:20.896182060 CET	80	49988	178.79.242.147	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 30, 2021 12:48:04.950474024 CET	58361	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:05.000266075 CET	53	58361	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:05.916078091 CET	63492	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:05.977796078 CET	53	63492	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:07.188783884 CET	60831	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:07.247627020 CET	53	60831	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:08.058758020 CET	60100	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:08.110042095 CET	53	60100	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:09.236071110 CET	53195	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:09.283911943 CET	53	53195	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:10.007205009 CET	50141	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:10.058034897 CET	53	50141	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:16.290100098 CET	53023	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:16.340440989 CET	53	53023	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:17.536242008 CET	49563	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:17.592472076 CET	53	49563	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:18.353142023 CET	51352	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:18.401133060 CET	53	51352	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:19.165293932 CET	59349	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:19.216461897 CET	53	59349	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:20.006800890 CET	57084	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:20.054795027 CET	53	57084	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:25.840014935 CET	58823	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:25.892249107 CET	53	58823	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:28.662755013 CET	57568	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:28.737612963 CET	53	57568	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:31.265887976 CET	50540	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:31.327186108 CET	53	50540	8.8.8.8	192.168.2.3
Jan 30, 2021 12:48:32.620985985 CET	54366	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:48:32.671730042 CET	53	54366	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:02.739723921 CET	53034	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:02.799410105 CET	53	53034	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:11.550277948 CET	57762	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:11.608647108 CET	53	57762	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:11.614160061 CET	55435	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:11.662143946 CET	53	55435	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:22.067089081 CET	50713	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:22.125644922 CET	53	50713	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:25.743300915 CET	56132	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:25.800045967 CET	53	56132	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:39.942575932 CET	5351	5351	192.168.2.3	192.168.2.1
Jan 30, 2021 12:50:39.942660093 CET	5351	5351	192.168.2.3	192.168.2.1
Jan 30, 2021 12:50:40.151827097 CET	58987	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:40.211179972 CET	53	58987	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:40.427870989 CET	56579	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:40.487592936 CET	53	56579	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:40.630157948 CET	5351	5351	192.168.2.3	192.168.2.1
Jan 30, 2021 12:50:40.630232096 CET	5351	5351	192.168.2.3	192.168.2.1
Jan 30, 2021 12:50:40.630245924 CET	5351	5351	192.168.2.3	192.168.2.1
Jan 30, 2021 12:50:40.786119938 CET	17720	6881	192.168.2.3	82.221.103.244
Jan 30, 2021 12:50:40.786231995 CET	17720	6881	192.168.2.3	67.215.246.10
Jan 30, 2021 12:50:40.876478910 CET	6881	17720	82.221.103.244	192.168.2.3
Jan 30, 2021 12:50:40.914478064 CET	17720	1045	192.168.2.3	189.250.0.174
Jan 30, 2021 12:50:40.914552927 CET	17720	26816	192.168.2.3	92.249.157.115
Jan 30, 2021 12:50:40.914665937 CET	17720	6881	192.168.2.3	69.119.127.215
Jan 30, 2021 12:50:40.914752007 CET	17720	6881	192.168.2.3	161.230.30.190
Jan 30, 2021 12:50:40.963361025 CET	6881	17720	67.215.246.10	192.168.2.3
Jan 30, 2021 12:50:40.970129013 CET	17720	6881	192.168.2.3	180.245.10.11
Jan 30, 2021 12:50:40.970274925 CET	17720	16831	192.168.2.3	89.240.209.7
Jan 30, 2021 12:50:40.970390081 CET	17720	8000	192.168.2.3	59.97.170.49
Jan 30, 2021 12:50:41.000628948 CET	26816	17720	92.249.157.115	192.168.2.3
Jan 30, 2021 12:50:41.005614996 CET	6881	17720	161.230.30.190	192.168.2.3
Jan 30, 2021 12:50:41.028942108 CET	17720	6881	192.168.2.3	206.188.117.12
Jan 30, 2021 12:50:41.029061079 CET	17720	62443	192.168.2.3	27.57.254.186
Jan 30, 2021 12:50:41.029238939 CET	17720	5366	192.168.2.3	121.237.191.0
Jan 30, 2021 12:50:41.029485941 CET	17720	56425	192.168.2.3	91.103.78.235
Jan 30, 2021 12:50:41.029551983 CET	17720	51413	192.168.2.3	113.69.119.93
Jan 30, 2021 12:50:41.029680014 CET	17720	50321	192.168.2.3	173.172.64.220
Jan 30, 2021 12:50:41.034589052 CET	16831	17720	89.240.209.7	192.168.2.3
Jan 30, 2021 12:50:41.034898043 CET	17720	6881	192.168.2.3	79.44.24.80
Jan 30, 2021 12:50:41.035049915 CET	17720	8999	192.168.2.3	77.70.30.189
Jan 30, 2021 12:50:41.035092115 CET	17720	17494	192.168.2.3	81.183.59.95
Jan 30, 2021 12:50:41.101866007 CET	17494	17720	81.183.59.95	192.168.2.3
Jan 30, 2021 12:50:41.115355015 CET	56425	17720	91.103.78.235	192.168.2.3
Jan 30, 2021 12:50:41.115735054 CET	8999	17720	77.70.30.189	192.168.2.3
Jan 30, 2021 12:50:41.149677992 CET	1045	17720	189.250.0.174	192.168.2.3
Jan 30, 2021 12:50:41.197941065 CET	17720	37033	192.168.2.3	217.65.108.62
Jan 30, 2021 12:50:41.198373079 CET	17720	51413	192.168.2.3	94.36.132.239
Jan 30, 2021 12:50:41.198832989 CET	17720	17572	192.168.2.3	193.77.69.5
Jan 30, 2021 12:50:41.200181961 CET	17720	24284	192.168.2.3	87.92.146.184
Jan 30, 2021 12:50:41.200731993 CET	17720	17642	192.168.2.3	95.87.199.169
Jan 30, 2021 12:50:41.203468084 CET	6881	17720	206.188.117.12	192.168.2.3
Jan 30, 2021 12:50:41.241626978 CET	50321	17720	173.172.64.220	192.168.2.3
Jan 30, 2021 12:50:41.247406960 CET	62443	17720	27.57.254.186	192.168.2.3
Jan 30, 2021 12:50:41.255512953 CET	51413	17720	94.36.132.239	192.168.2.3
Jan 30, 2021 12:50:41.255547047 CET	17572	17720	193.77.69.5	192.168.2.3
Jan 30, 2021 12:50:41.255826950 CET	17720	19423	192.168.2.3	86.92.71.126
Jan 30, 2021 12:50:41.255995035 CET	17720	56507	192.168.2.3	67.167.124.173
Jan 30, 2021 12:50:41.256082058 CET	17720	12405	192.168.2.3	89.64.54.152
Jan 30, 2021 12:50:41.256253004 CET	17720	51413	192.168.2.3	98.115.85.132
Jan 30, 2021 12:50:41.269588947 CET	24284	17720	87.92.146.184	192.168.2.3
Jan 30, 2021 12:50:41.269895077 CET	17720	52379	192.168.2.3	47.55.190.78
Jan 30, 2021 12:50:41.270092010 CET	17720	39349	192.168.2.3	37.79.91.224
Jan 30, 2021 12:50:41.270143032 CET	17720	55090	192.168.2.3	185.14.28.165
Jan 30, 2021 12:50:41.274123907 CET	17642	17720	95.87.199.169	192.168.2.3
Jan 30, 2021 12:50:41.281608105 CET	37033	17720	217.65.108.62	192.168.2.3
Jan 30, 2021 12:50:41.281941891 CET	17720	6911	192.168.2.3	52.8.36.62
Jan 30, 2021 12:50:41.282128096 CET	17720	6926	192.168.2.3	3.211.230.23
Jan 30, 2021 12:50:41.282183886 CET	17720	1910	192.168.2.3	5.9.67.240
Jan 30, 2021 12:50:41.282301903 CET	17720	6881	192.168.2.3	119.8.127.135
Jan 30, 2021 12:50:41.294411898 CET	8000	17720	59.97.170.49	192.168.2.3
Jan 30, 2021 12:50:41.310532093 CET	19423	17720	86.92.71.126	192.168.2.3
Jan 30, 2021 12:50:41.318952084 CET	55090	17720	185.14.28.165	192.168.2.3
Jan 30, 2021 12:50:41.321002007 CET	12405	17720	89.64.54.152	192.168.2.3
Jan 30, 2021 12:50:41.388493061 CET	51413	17720	98.115.85.132	192.168.2.3
Jan 30, 2021 12:50:41.412050009 CET	56507	17720	67.167.124.173	192.168.2.3
Jan 30, 2021 12:50:41.426989079 CET	52379	17720	47.55.190.78	192.168.2.3
Jan 30, 2021 12:50:41.471028090 CET	39349	17720	37.79.91.224	192.168.2.3
Jan 30, 2021 12:50:41.663360119 CET	17720	26816	192.168.2.3	92.249.157.115
Jan 30, 2021 12:50:41.663403034 CET	17720	1045	192.168.2.3	189.250.0.174
Jan 30, 2021 12:50:41.663463116 CET	17720	8000	192.168.2.3	59.97.170.49
Jan 30, 2021 12:50:41.663589954 CET	17720	6881	192.168.2.3	206.188.117.12
Jan 30, 2021 12:50:41.663634062 CET	17720	63972	192.168.2.3	49.34.70.36
Jan 30, 2021 12:50:41.751617908 CET	26816	17720	92.249.157.115	192.168.2.3
Jan 30, 2021 12:50:41.752052069 CET	17720	18994	192.168.2.3	219.79.117.83
Jan 30, 2021 12:50:41.752136946 CET	17720	49093	192.168.2.3	121.45.79.34
Jan 30, 2021 12:50:41.752237082 CET	17720	49269	192.168.2.3	176.63.24.100
Jan 30, 2021 12:50:41.752336025 CET	17720	54313	192.168.2.3	208.110.106.75
Jan 30, 2021 12:50:41.828001022 CET	49269	17720	176.63.24.100	192.168.2.3
Jan 30, 2021 12:50:41.846462965 CET	6881	17720	206.188.117.12	192.168.2.3
Jan 30, 2021 12:50:41.851217985 CET	17720	6881	192.168.2.3	118.14.200.58
Jan 30, 2021 12:50:41.851308107 CET	17720	19559	192.168.2.3	178.140.10.27
Jan 30, 2021 12:50:41.851358891 CET	17720	11916	192.168.2.3	213.136.79.7
Jan 30, 2021 12:50:41.851599932 CET	17720	6881	192.168.2.3	79.140.26.93
Jan 30, 2021 12:50:41.897691011 CET	1045	17720	189.250.0.174	192.168.2.3
Jan 30, 2021 12:50:41.937069893 CET	19559	17720	178.140.10.27	192.168.2.3
Jan 30, 2021 12:50:41.954077959 CET	6881	17720	79.140.26.93	192.168.2.3
Jan 30, 2021 12:50:41.955840111 CET	17720	22338	192.168.2.3	1.164.146.117
Jan 30, 2021 12:50:41.956178904 CET	17720	34277	192.168.2.3	134.249.127.48
Jan 30, 2021 12:50:41.956485987 CET	17720	13329	192.168.2.3	185.165.160.176
Jan 30, 2021 12:50:41.963516951 CET	17720	51413	192.168.2.3	126.142.30.153
Jan 30, 2021 12:50:41.964221001 CET	17720	62898	192.168.2.3	54.39.2.195
Jan 30, 2021 12:50:41.964518070 CET	17720	49001	192.168.2.3	149.255.29.135
Jan 30, 2021 12:50:41.964778900 CET	17720	51413	192.168.2.3	198.12.121.229
Jan 30, 2021 12:50:41.967474937 CET	60633	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:42.015863895 CET	61292	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:42.026731968 CET	34277	17720	134.249.127.48	192.168.2.3
Jan 30, 2021 12:50:42.029129982 CET	53	60633	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:42.049699068 CET	13329	17720	185.165.160.176	192.168.2.3
Jan 30, 2021 12:50:42.063338995 CET	49001	17720	149.255.29.135	192.168.2.3
Jan 30, 2021 12:50:42.063776016 CET	53	61292	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:42.095948935 CET	54313	17720	208.110.106.75	192.168.2.3
Jan 30, 2021 12:50:42.100151062 CET	62898	17720	54.39.2.195	192.168.2.3
Jan 30, 2021 12:50:42.122746944 CET	17720	6881	192.168.2.3	112.168.71.78
Jan 30, 2021 12:50:42.122860909 CET	17720	22425	192.168.2.3	88.90.139.39
Jan 30, 2021 12:50:42.122908115 CET	17720	29690	192.168.2.3	62.205.202.181
Jan 30, 2021 12:50:42.123059034 CET	17720	5691	192.168.2.3	183.167.31.157
Jan 30, 2021 12:50:42.123354912 CET	17720	60160	192.168.2.3	212.32.243.15
Jan 30, 2021 12:50:42.123488903 CET	17720	1033	192.168.2.3	94.251.128.6
Jan 30, 2021 12:50:42.151807070 CET	49093	17720	121.45.79.34	192.168.2.3
Jan 30, 2021 12:50:42.163408995 CET	51413	17720	198.12.121.229	192.168.2.3
Jan 30, 2021 12:50:42.175731897 CET	60160	17720	212.32.243.15	192.168.2.3
Jan 30, 2021 12:50:42.193325043 CET	29690	17720	62.205.202.181	192.168.2.3
Jan 30, 2021 12:50:42.214020014 CET	17720	38811	192.168.2.3	2.135.114.157
Jan 30, 2021 12:50:42.214190006 CET	17720	6881	192.168.2.3	176.65.116.74
Jan 30, 2021 12:50:42.214329958 CET	17720	8621	192.168.2.3	195.38.11.55
Jan 30, 2021 12:50:42.219921112 CET	22425	17720	88.90.139.39	192.168.2.3
Jan 30, 2021 12:50:42.252638102 CET	22338	17720	1.164.146.117	192.168.2.3
Jan 30, 2021 12:50:42.258172989 CET	17720	6881	192.168.2.3	112.168.71.78
Jan 30, 2021 12:50:42.299200058 CET	51413	17720	126.142.30.153	192.168.2.3
Jan 30, 2021 12:50:42.400080919 CET	6881	17720	112.168.71.78	192.168.2.3
Jan 30, 2021 12:50:42.534166098 CET	6881	17720	112.168.71.78	192.168.2.3
Jan 30, 2021 12:50:42.660641909 CET	8000	17720	59.97.170.49	192.168.2.3
Jan 30, 2021 12:50:42.990792036 CET	63619	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:43.049701929 CET	53	63619	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:43.357119083 CET	64938	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:43.415944099 CET	53	64938	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:43.698685884 CET	61946	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:43.757728100 CET	53	61946	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:44.060581923 CET	64910	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:44.212619066 CET	17720	29101	192.168.2.3	102.142.65.153
Jan 30, 2021 12:50:44.212693930 CET	17720	50155	192.168.2.3	94.190.193.153
Jan 30, 2021 12:50:44.212768078 CET	17720	62544	192.168.2.3	42.111.6.220
Jan 30, 2021 12:50:44.267920971 CET	53	64910	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:45.245126009 CET	17720	49001	192.168.2.3	80.251.153.186
Jan 30, 2021 12:50:45.245208025 CET	17720	50321	192.168.2.3	208.96.115.15
Jan 30, 2021 12:50:45.245228052 CET	17720	50808	192.168.2.3	2.61.72.86
Jan 30, 2021 12:50:45.360924959 CET	49001	17720	80.251.153.186	192.168.2.3
Jan 30, 2021 12:50:45.373332977 CET	17720	45381	192.168.2.3	84.17.52.74
Jan 30, 2021 12:50:45.390561104 CET	50808	17720	2.61.72.86	192.168.2.3
Jan 30, 2021 12:50:45.391041040 CET	17720	6881	192.168.2.3	18.218.241.3
Jan 30, 2021 12:50:45.402021885 CET	50321	17720	208.96.115.15	192.168.2.3
Jan 30, 2021 12:50:46.338983059 CET	6881	17720	18.218.241.3	192.168.2.3
Jan 30, 2021 12:50:46.362103939 CET	17720	25313	192.168.2.3	92.240.51.15
Jan 30, 2021 12:50:46.441417933 CET	25313	17720	92.240.51.15	192.168.2.3
Jan 30, 2021 12:50:46.456044912 CET	17720	6881	192.168.2.3	13.58.27.33
Jan 30, 2021 12:50:46.456206083 CET	17720	6881	192.168.2.3	18.223.137.220
Jan 30, 2021 12:50:47.230870008 CET	17720	6882	192.168.2.3	161.97.90.50
Jan 30, 2021 12:50:47.324687958 CET	6881	17720	13.58.27.33	192.168.2.3
Jan 30, 2021 12:50:48.203247070 CET	17720	18086	192.168.2.3	110.87.72.111
Jan 30, 2021 12:50:49.823848963 CET	17720	40343	192.168.2.3	188.242.61.133
Jan 30, 2021 12:50:49.823915958 CET	17720	6889	192.168.2.3	84.107.14.129
Jan 30, 2021 12:50:49.824012995 CET	17720	38811	192.168.2.3	2.135.114.157
Jan 30, 2021 12:50:49.904575109 CET	6889	17720	84.107.14.129	192.168.2.3
Jan 30, 2021 12:50:49.908896923 CET	40343	17720	188.242.61.133	192.168.2.3
Jan 30, 2021 12:50:49.922508001 CET	17720	35027	192.168.2.3	78.182.153.125
Jan 30, 2021 12:50:49.922780991 CET	17720	6881	192.168.2.3	54.194.137.170
Jan 30, 2021 12:50:49.922878981 CET	17720	6881	192.168.2.3	210.6.117.216
Jan 30, 2021 12:50:50.905922890 CET	35027	17720	78.182.153.125	192.168.2.3
Jan 30, 2021 12:50:50.907958984 CET	17720	6881	192.168.2.3	38.121.71.145
Jan 30, 2021 12:50:51.225678921 CET	17720	42260	192.168.2.3	47.92.124.237
Jan 30, 2021 12:50:51.225742102 CET	17720	23951	192.168.2.3	188.163.58.192
Jan 30, 2021 12:50:51.306444883 CET	23951	17720	188.163.58.192	192.168.2.3
Jan 30, 2021 12:50:52.214538097 CET	17720	1152	192.168.2.3	188.138.137.196
Jan 30, 2021 12:50:53.274557114 CET	18994	17720	219.79.117.83	192.168.2.3
Jan 30, 2021 12:50:53.354659081 CET	17720	3276	192.168.2.3	212.46.18.149
Jan 30, 2021 12:50:53.354774952 CET	17720	31987	192.168.2.3	176.63.21.208
Jan 30, 2021 12:50:53.425209999 CET	31987	17720	176.63.21.208	192.168.2.3
Jan 30, 2021 12:50:53.440752029 CET	3276	17720	212.46.18.149	192.168.2.3
Jan 30, 2021 12:50:54.554045916 CET	52123	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:54.613215923 CET	53	52123	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:55.960676908 CET	56130	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:56.019963026 CET	53	56130	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:56.203818083 CET	17720	6881	192.168.2.3	176.65.116.74
Jan 30, 2021 12:50:56.534193993 CET	56338	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:56.582144976 CET	53	56338	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:56.952105045 CET	59420	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:57.014291048 CET	53	59420	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:57.220422983 CET	17720	6882	192.168.2.3	161.97.90.50
Jan 30, 2021 12:50:57.321314096 CET	58784	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:57.377742052 CET	53	58784	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:57.660459995 CET	63978	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:57.716604948 CET	53	63978	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:57.979933977 CET	62938	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:58.038413048 CET	53	62938	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:58.089689970 CET	55708	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:58.149122000 CET	53	55708	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:58.244909048 CET	56803	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:58.245317936 CET	57145	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:58.303916931 CET	53	56803	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:58.305043936 CET	53	57145	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:58.314230919 CET	55359	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:58.367811918 CET	53	55359	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:58.396048069 CET	58306	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:58.452511072 CET	53	58306	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:58.517501116 CET	6882	17720	161.97.90.50	192.168.2.3
Jan 30, 2021 12:50:58.636111975 CET	64124	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:58.694819927 CET	53	64124	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:58.980073929 CET	49361	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:59.039278030 CET	53	49361	8.8.8.8	192.168.2.3
Jan 30, 2021 12:50:59.635034084 CET	63150	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:50:59.693614006 CET	53	63150	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:00.021044016 CET	53279	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:00.071913004 CET	53	53279	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:00.196213007 CET	56881	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:00.244450092 CET	53	56881	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:00.484993935 CET	53642	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:00.569412947 CET	53	53642	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:00.573699951 CET	55667	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:00.634735107 CET	53	55667	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:01.104361057 CET	54833	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:01.106983900 CET	62476	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:01.123466969 CET	49705	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:01.154905081 CET	53	54833	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:01.169311047 CET	61477	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:01.176240921 CET	53	62476	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:01.183485031 CET	61633	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:01.183602095 CET	53	49705	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:01.233633041 CET	53	61477	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:01.249196053 CET	53	61633	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:01.285012960 CET	55949	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:01.318767071 CET	57601	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:01.348912001 CET	53	55949	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:01.379023075 CET	53	57601	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:01.666784048 CET	49342	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:01.677737951 CET	56253	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:01.733850002 CET	53	49342	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:01.734302044 CET	53	56253	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:02.189681053 CET	49667	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:02.192781925 CET	55439	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:02.248943090 CET	53	55439	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:02.360099077 CET	57069	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:02.396023989 CET	53	49667	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:02.416579008 CET	53	57069	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:02.458950043 CET	57659	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:02.462515116 CET	54717	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:02.470391035 CET	63975	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:02.520191908 CET	53	57659	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:02.529295921 CET	53	54717	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:02.531044960 CET	53	63975	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:02.678693056 CET	56639	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:02.739417076 CET	53	56639	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:02.800870895 CET	51856	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:02.857218981 CET	53	51856	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:03.676417112 CET	56546	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:03.745161057 CET	53	56546	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:03.868175030 CET	62152	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:03.920555115 CET	53	62152	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:03.978378057 CET	53470	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:04.036355972 CET	53	53470	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:04.246197939 CET	17720	8621	192.168.2.3	195.38.11.55
Jan 30, 2021 12:51:04.544192076 CET	56446	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:04.594275951 CET	59631	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:04.600513935 CET	53	56446	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:04.642045975 CET	53	59631	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:04.678719997 CET	55515	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:04.728821993 CET	53	55515	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:04.771585941 CET	64547	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:04.827498913 CET	53	64547	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:04.866044044 CET	51759	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:04.913878918 CET	53	51759	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:05.020020008 CET	59207	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:05.072035074 CET	53	59207	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:05.296438932 CET	54269	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:05.355566978 CET	53	54269	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:05.490551949 CET	54856	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:05.503002882 CET	64140	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:05.543080091 CET	53	54856	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:05.570483923 CET	53	64140	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:09.112042904 CET	62271	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:09.168708086 CET	53	62271	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:10.073522091 CET	57404	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:10.112294912 CET	62997	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:10.135123014 CET	53	57404	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:10.174165010 CET	53	62997	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:11.263328075 CET	57712	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:11.328094959 CET	53	57712	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:15.827852964 CET	60065	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:15.879215002 CET	53	60065	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:19.170001984 CET	55068	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:19.220587015 CET	53	55068	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:26.395529032 CET	64700	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:26.452094078 CET	53	64700	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:27.805165052 CET	61998	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:27.844347954 CET	17720	29101	192.168.2.3	102.142.65.153
Jan 30, 2021 12:51:27.855547905 CET	53	61998	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:27.969360113 CET	53724	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:28.019785881 CET	53	53724	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:28.488157034 CET	52328	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:28.544473886 CET	53	52328	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:29.020010948 CET	53724	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:29.080352068 CET	53	53724	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:29.206265926 CET	58051	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:29.265582085 CET	53	58051	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:30.043840885 CET	53724	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:30.101427078 CET	53	53724	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:30.221057892 CET	58051	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:30.272125959 CET	53	58051	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:31.227104902 CET	58051	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:31.288814068 CET	53	58051	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:32.074009895 CET	53724	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:32.132656097 CET	53	53724	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:33.260763884 CET	58051	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:33.313579082 CET	53	58051	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:35.386415958 CET	64130	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:35.445441961 CET	53	64130	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:35.934637070 CET	50491	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:35.990618944 CET	53	50491	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:36.172457933 CET	53724	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:36.222019911 CET	53	53724	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:36.414957047 CET	53004	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:36.471436024 CET	53	53004	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:36.874217987 CET	52529	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:36.932073116 CET	53	52529	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:37.361787081 CET	58051	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:37.414478064 CET	53	58051	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:40.151223898 CET	53656	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:40.207457066 CET	53	53656	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:40.479908943 CET	62724	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:40.539268017 CET	53	62724	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:40.824362993 CET	56059	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:40.880886078 CET	53	56059	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:42.334654093 CET	63060	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:42.382811069 CET	53	63060	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:42.968369007 CET	51498	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:43.026860952 CET	53	51498	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:43.194221973 CET	17720	50155	192.168.2.3	94.190.193.153
Jan 30, 2021 12:51:43.287501097 CET	59943	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:43.340665102 CET	53	59943	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:43.603176117 CET	50118	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:43.661741018 CET	53	50118	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:43.945980072 CET	58357	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:44.004060030 CET	53	58357	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:44.283627987 CET	55804	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:44.340055943 CET	53	55804	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:44.604341030 CET	58079	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:44.665760994 CET	53	58079	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:44.992409945 CET	52080	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:45.050019979 CET	53	52080	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:45.363882065 CET	55238	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:45.422096014 CET	53	55238	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:45.684237003 CET	49289	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:45.744059086 CET	53	49289	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:46.010951042 CET	61034	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:46.067178011 CET	53	61034	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:46.417562008 CET	51964	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:46.476651907 CET	53	51964	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:46.758884907 CET	58241	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:46.818350077 CET	53	58241	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:47.221117020 CET	59571	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:47.277529955 CET	53	59571	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:47.604995966 CET	51708	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:47.666987896 CET	53	51708	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:47.989731073 CET	60709	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:48.048152924 CET	53	60709	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:48.338018894 CET	63643	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:48.394547939 CET	53	63643	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:48.721247911 CET	62823	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:48.779051065 CET	53	62823	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:49.063975096 CET	63750	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:51:49.113298893 CET	53	63750	8.8.8.8	192.168.2.3
Jan 30, 2021 12:51:49.856301069 CET	17720	45381	192.168.2.3	84.17.52.74
Jan 30, 2021 12:51:56.874062061 CET	17720	6881	192.168.2.3	18.218.241.3
Jan 30, 2021 12:51:57.832525015 CET	6881	17720	18.218.241.3	192.168.2.3
Jan 30, 2021 12:52:03.859114885 CET	17720	6881	192.168.2.3	13.58.27.33
Jan 30, 2021 12:52:04.874751091 CET	6881	17720	13.58.27.33	192.168.2.3
Jan 30, 2021 12:52:10.500108957 CET	61959	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:52:10.551425934 CET	53	61959	8.8.8.8	192.168.2.3
Jan 30, 2021 12:52:10.901278019 CET	17720	6881	192.168.2.3	18.223.137.220
Jan 30, 2021 12:52:11.788988113 CET	6881	17720	18.223.137.220	192.168.2.3
Jan 30, 2021 12:52:17.950336933 CET	17720	6881	192.168.2.3	210.6.117.216
Jan 30, 2021 12:52:19.596874952 CET	63554	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:52:19.806502104 CET	53	63554	8.8.8.8	192.168.2.3
Jan 30, 2021 12:52:20.117885113 CET	57723	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:52:20.179730892 CET	53	57723	8.8.8.8	192.168.2.3
Jan 30, 2021 12:52:20.502969027 CET	58663	53	192.168.2.3	8.8.8.8
Jan 30, 2021 12:52:20.562185049 CET	53	58663	8.8.8.8	192.168.2.3
Jan 30, 2021 12:52:20.841681957 CET	50980	53	192.168.2.3	8.8.8.8

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 30, 2021 12:50:39.942611933 CET	192.168.2.1	192.168.2.3	8277	(Port unreachable)	Destination Unreachable
Jan 30, 2021 12:50:39.942667007 CET	192.168.2.1	192.168.2.3	8277	(Port unreachable)	Destination Unreachable
Jan 30, 2021 12:50:40.630212069 CET	192.168.2.1	192.168.2.3	8277	(Port unreachable)	Destination Unreachable
Jan 30, 2021 12:50:40.630242109 CET	192.168.2.1	192.168.2.3	8277	(Port unreachable)	Destination Unreachable
Jan 30, 2021 12:50:40.630253077 CET	192.168.2.1	192.168.2.3	826d	(Port unreachable)	Destination Unreachable
Jan 30, 2021 12:50:41.195667028 CET	180.245.10.11	192.168.2.3	7f29	(Port unreachable)	Destination Unreachable
Jan 30, 2021 12:50:42.168076992 CET	49.34.70.36	192.168.2.3	376f	(Port unreachable)	Destination Unreachable
Jan 30, 2021 12:50:44.728106976 CET	42.111.6.220	192.168.2.3	f32f	(Port unreachable)	Destination Unreachable
Jan 30, 2021 12:50:46.386955023 CET	102.142.65.153	192.168.2.3	6852	(Host unreachable)	Destination Unreachable
Jan 30, 2021 12:51:30.665214062 CET	102.142.65.153	192.168.2.3	6852	(Host unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 30, 2021 12:50:11.550277948 CET	192.168.2.3	8.8.8.8	0xad4	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:11.614160061 CET	192.168.2.3	8.8.8.8	0xe611	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:22.067089081 CET	192.168.2.3	8.8.8.8	0xa4c8	Standard query (0)	i-21.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:25.743300915 CET	192.168.2.3	8.8.8.8	0x7e48	Standard query (0)	i-30.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:40.151827097 CET	192.168.2.3	8.8.8.8	0x6ed2	Standard query (0)	apps.bittorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:40.427870989 CET	192.168.2.3	8.8.8.8	0x1bab	Standard query (0)	i-67.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:41.967474937 CET	192.168.2.3	8.8.8.8	0x2675	Standard query (0)	i-29.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:42.015863895 CET	192.168.2.3	8.8.8.8	0x2ebb	Standard query (0)	update.bittorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:42.990792036 CET	192.168.2.3	8.8.8.8	0x5a2d	Standard query (0)	i-29.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.357119083 CET	192.168.2.3	8.8.8.8	0x49fc	Standard query (0)	i-21.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.698685884 CET	192.168.2.3	8.8.8.8	0x2023	Standard query (0)	i-32.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:44.060581923 CET	192.168.2.3	8.8.8.8	0x47f6	Standard query (0)	i-49.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:54.554045916 CET	192.168.2.3	8.8.8.8	0x2730	Standard query (0)	i-20.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:55.960676908 CET	192.168.2.3	8.8.8.8	0x15e9	Standard query (0)	i-38.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:56.534193993 CET	192.168.2.3	8.8.8.8	0x7860	Standard query (0)	cdn.ap.bittorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:56.952105045 CET	192.168.2.3	8.8.8.8	0x18ee	Standard query (0)	cdn.bitmedianetwork.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.321314096 CET	192.168.2.3	8.8.8.8	0x9326	Standard query (0)	i-64.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.660459995 CET	192.168.2.3	8.8.8.8	0x6925	Standard query (0)	i-62.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.979933977 CET	192.168.2.3	8.8.8.8	0xeb6a	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.089689970 CET	192.168.2.3	8.8.8.8	0x585	Standard query (0)	i-1006.b-0.ad.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.244909048 CET	192.168.2.3	8.8.8.8	0x26b7	Standard query (0)	utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.314230919 CET	192.168.2.3	8.8.8.8	0xfab7	Standard query (0)	i-38.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.396048069 CET	192.168.2.3	8.8.8.8	0xd8ab	Standard query (0)	engine.bitmedianetwork.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.636111975 CET	192.168.2.3	8.8.8.8	0x12d	Standard query (0)	i-62.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.980073929 CET	192.168.2.3	8.8.8.8	0xd00a	Standard query (0)	i-67.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.635034084 CET	192.168.2.3	8.8.8.8	0xe160	Standard query (0)	i-62.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.021044016 CET	192.168.2.3	8.8.8.8	0x5a1	Standard query (0)	utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.196213007 CET	192.168.2.3	8.8.8.8	0xf9c	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.484993935 CET	192.168.2.3	8.8.8.8	0x469e	Standard query (0)	www.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.573699951 CET	192.168.2.3	8.8.8.8	0xd9f3	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.104361057 CET	192.168.2.3	8.8.8.8	0x6c61	Standard query (0)	i-38.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.123466969 CET	192.168.2.3	8.8.8.8	0xbc1f	Standard query (0)	sdk.privacy-center.org	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.169311047 CET	192.168.2.3	8.8.8.8	0xd246	Standard query (0)	cdn.optimizely.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.285012960 CET	192.168.2.3	8.8.8.8	0x8680	Standard query (0)	www.bt.co	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.318767071 CET	192.168.2.3	8.8.8.8	0x5ce8	Standard query (0)	secure.quantserve.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.189681053 CET	192.168.2.3	8.8.8.8	0xf200	Standard query (0)	cdn-assets.bittorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.192781925 CET	192.168.2.3	8.8.8.8	0x6d0f	Standard query (0)	video.trontv.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.360099077 CET	192.168.2.3	8.8.8.8	0x99af	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.458950043 CET	192.168.2.3	8.8.8.8	0x583b	Standard query (0)	s.zkcdn.net	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.470391035 CET	192.168.2.3	8.8.8.8	0x2591	Standard query (0)	ssum.casalemedia.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.678693056 CET	192.168.2.3	8.8.8.8	0x599d	Standard query (0)	cdn3.optimizely.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.800870895 CET	192.168.2.3	8.8.8.8	0xcbce	Standard query (0)	50136351.log.optimizely.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:03.676417112 CET	192.168.2.3	8.8.8.8	0x801	Standard query (0)	a8230037.cdn.optimizely.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:03.868175030 CET	192.168.2.3	8.8.8.8	0x16c8	Standard query (0)	static.ads-twitter.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:03.978378057 CET	192.168.2.3	8.8.8.8	0x304a	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.544192076 CET	192.168.2.3	8.8.8.8	0x9124	Standard query (0)	video.trontv.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.594275951 CET	192.168.2.3	8.8.8.8	0x37ae	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.678719997 CET	192.168.2.3	8.8.8.8	0x44d	Standard query (0)	logx.optimizely.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.771585941 CET	192.168.2.3	8.8.8.8	0xf6ad	Standard query (0)	update.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.866044044 CET	192.168.2.3	8.8.8.8	0x1f03	Standard query (0)	analytics.twitter.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.020020008 CET	192.168.2.3	8.8.8.8	0x50b3	Standard query (0)	t.co	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.296438932 CET	192.168.2.3	8.8.8.8	0xe87f	Standard query (0)	media.adaware.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.490551949 CET	192.168.2.3	8.8.8.8	0xaa31	Standard query (0)	btinstall-artifacts.bittorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.503002882 CET	192.168.2.3	8.8.8.8	0xcab5	Standard query (0)	sdk.privacy-center.org	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:09.112042904 CET	192.168.2.3	8.8.8.8	0x11af	Standard query (0)	sdk.privacy-center.org	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.073522091 CET	192.168.2.3	8.8.8.8	0x2939	Standard query (0)	i-1006.b-0.ad.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.112294912 CET	192.168.2.3	8.8.8.8	0x7577	Standard query (0)	www9.smartadserver.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:11.263328075 CET	192.168.2.3	8.8.8.8	0x80c7	Standard query (0)	utclient.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:15.827852964 CET	192.168.2.3	8.8.8.8	0xcd36	Standard query (0)	i-3100.b-0.ad.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:19.170001984 CET	192.168.2.3	8.8.8.8	0x107b	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:26.395529032 CET	192.168.2.3	8.8.8.8	0x98eb	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:27.805165052 CET	192.168.2.3	8.8.8.8	0xc227	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:28.488157034 CET	192.168.2.3	8.8.8.8	0xa2f0	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.386415958 CET	192.168.2.3	8.8.8.8	0x2ec1	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.934637070 CET	192.168.2.3	8.8.8.8	0x777d	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.414957047 CET	192.168.2.3	8.8.8.8	0xf46c	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.874217987 CET	192.168.2.3	8.8.8.8	0x9a67	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.151223898 CET	192.168.2.3	8.8.8.8	0xacd1	Standard query (0)	i-61.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.479908943 CET	192.168.2.3	8.8.8.8	0x98b5	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.824362993 CET	192.168.2.3	8.8.8.8	0xa4df	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:42.334654093 CET	192.168.2.3	8.8.8.8	0xd3f3	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:42.968369007 CET	192.168.2.3	8.8.8.8	0x4a2b	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.287501097 CET	192.168.2.3	8.8.8.8	0xba32	Standard query (0)	i-64.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.603176117 CET	192.168.2.3	8.8.8.8	0xb36c	Standard query (0)	i-61.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.945980072 CET	192.168.2.3	8.8.8.8	0x1e29	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.283627987 CET	192.168.2.3	8.8.8.8	0xf1cf	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.604341030 CET	192.168.2.3	8.8.8.8	0x3bcb	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.992409945 CET	192.168.2.3	8.8.8.8	0xb540	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.363882065 CET	192.168.2.3	8.8.8.8	0xbdda	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.684237003 CET	192.168.2.3	8.8.8.8	0xd495	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.010951042 CET	192.168.2.3	8.8.8.8	0xd49d	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.417562008 CET	192.168.2.3	8.8.8.8	0xf43b	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.758884907 CET	192.168.2.3	8.8.8.8	0x2306	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.221117020 CET	192.168.2.3	8.8.8.8	0x3cdc	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.604995966 CET	192.168.2.3	8.8.8.8	0xeb10	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.989731073 CET	192.168.2.3	8.8.8.8	0x279d	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.338018894 CET	192.168.2.3	8.8.8.8	0x5431	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.721247911 CET	192.168.2.3	8.8.8.8	0xb153	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:49.063975096 CET	192.168.2.3	8.8.8.8	0xefc2	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:10.500108957 CET	192.168.2.3	8.8.8.8	0xdd9a	Standard query (0)	i-5600.b-1327.helper.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:19.596874952 CET	192.168.2.3	8.8.8.8	0x43a7	Standard query (0)	i-34.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.117885113 CET	192.168.2.3	8.8.8.8	0x772d	Standard query (0)	i-21.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.502969027 CET	192.168.2.3	8.8.8.8	0xadd0	Standard query (0)	i-34.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.841681957 CET	192.168.2.3	8.8.8.8	0x801	Standard query (0)	i-43.b-45852.ut.bench.utorrent.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 30, 2021 12:50:11.608647108 CET	8.8.8.8	192.168.2.3	0xad4	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:11.662143946 CET	8.8.8.8	192.168.2.3	0xe611	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:22.125644922 CET	8.8.8.8	192.168.2.3	0xa4c8	No error (0)	i-21.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:22.125644922 CET	8.8.8.8	192.168.2.3	0xa4c8	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:22.125644922 CET	8.8.8.8	192.168.2.3	0xa4c8	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:22.125644922 CET	8.8.8.8	192.168.2.3	0xa4c8	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:22.125644922 CET	8.8.8.8	192.168.2.3	0xa4c8	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:22.125644922 CET	8.8.8.8	192.168.2.3	0xa4c8	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:22.125644922 CET	8.8.8.8	192.168.2.3	0xa4c8	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:22.125644922 CET	8.8.8.8	192.168.2.3	0xa4c8	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:22.125644922 CET	8.8.8.8	192.168.2.3	0xa4c8	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:22.125644922 CET	8.8.8.8	192.168.2.3	0xa4c8	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.215.82	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:25.800045967 CET	8.8.8.8	192.168.2.3	0x7e48	No error (0)	i-30.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:25.800045967 CET	8.8.8.8	192.168.2.3	0x7e48	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:25.800045967 CET	8.8.8.8	192.168.2.3	0x7e48	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:25.800045967 CET	8.8.8.8	192.168.2.3	0x7e48	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:25.800045967 CET	8.8.8.8	192.168.2.3	0x7e48	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:25.800045967 CET	8.8.8.8	192.168.2.3	0x7e48	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:25.800045967 CET	8.8.8.8	192.168.2.3	0x7e48	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:25.800045967 CET	8.8.8.8	192.168.2.3	0x7e48	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:25.800045967 CET	8.8.8.8	192.168.2.3	0x7e48	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:25.800045967 CET	8.8.8.8	192.168.2.3	0x7e48	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.215.82	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:40.211179972 CET	8.8.8.8	192.168.2.3	0x6ed2	No error (0)	apps.bittorrent.com	bittorrent-1.hs.llnwd.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:40.211179972 CET	8.8.8.8	192.168.2.3	0x6ed2	No error (0)	bittorrent-1.hs.llnwd.net		178.79.242.147	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:40.487592936 CET	8.8.8.8	192.168.2.3	0x1bab	No error (0)	i-67.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:40.487592936 CET	8.8.8.8	192.168.2.3	0x1bab	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:40.487592936 CET	8.8.8.8	192.168.2.3	0x1bab	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:40.487592936 CET	8.8.8.8	192.168.2.3	0x1bab	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:40.487592936 CET	8.8.8.8	192.168.2.3	0x1bab	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:40.487592936 CET	8.8.8.8	192.168.2.3	0x1bab	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:40.487592936 CET	8.8.8.8	192.168.2.3	0x1bab	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:40.487592936 CET	8.8.8.8	192.168.2.3	0x1bab	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:40.487592936 CET	8.8.8.8	192.168.2.3	0x1bab	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:40.487592936 CET	8.8.8.8	192.168.2.3	0x1bab	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:42.029129982 CET	8.8.8.8	192.168.2.3	0x2675	No error (0)	i-29.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:42.029129982 CET	8.8.8.8	192.168.2.3	0x2675	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:42.029129982 CET	8.8.8.8	192.168.2.3	0x2675	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:42.029129982 CET	8.8.8.8	192.168.2.3	0x2675	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:42.029129982 CET	8.8.8.8	192.168.2.3	0x2675	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:42.029129982 CET	8.8.8.8	192.168.2.3	0x2675	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:42.029129982 CET	8.8.8.8	192.168.2.3	0x2675	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:42.029129982 CET	8.8.8.8	192.168.2.3	0x2675	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:42.029129982 CET	8.8.8.8	192.168.2.3	0x2675	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:42.029129982 CET	8.8.8.8	192.168.2.3	0x2675	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:42.063776016 CET	8.8.8.8	192.168.2.3	0x2ebb	No error (0)	update.bittorrent.com		173.254.195.58	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.049701929 CET	8.8.8.8	192.168.2.3	0x5a2d	No error (0)	i-29.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:43.049701929 CET	8.8.8.8	192.168.2.3	0x5a2d	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:43.049701929 CET	8.8.8.8	192.168.2.3	0x5a2d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.049701929 CET	8.8.8.8	192.168.2.3	0x5a2d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.049701929 CET	8.8.8.8	192.168.2.3	0x5a2d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.049701929 CET	8.8.8.8	192.168.2.3	0x5a2d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.049701929 CET	8.8.8.8	192.168.2.3	0x5a2d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.049701929 CET	8.8.8.8	192.168.2.3	0x5a2d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.049701929 CET	8.8.8.8	192.168.2.3	0x5a2d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.049701929 CET	8.8.8.8	192.168.2.3	0x5a2d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.415944099 CET	8.8.8.8	192.168.2.3	0x49fc	No error (0)	i-21.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:43.415944099 CET	8.8.8.8	192.168.2.3	0x49fc	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:43.415944099 CET	8.8.8.8	192.168.2.3	0x49fc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.415944099 CET	8.8.8.8	192.168.2.3	0x49fc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.415944099 CET	8.8.8.8	192.168.2.3	0x49fc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.415944099 CET	8.8.8.8	192.168.2.3	0x49fc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.415944099 CET	8.8.8.8	192.168.2.3	0x49fc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.415944099 CET	8.8.8.8	192.168.2.3	0x49fc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.415944099 CET	8.8.8.8	192.168.2.3	0x49fc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.415944099 CET	8.8.8.8	192.168.2.3	0x49fc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.215.82	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.757728100 CET	8.8.8.8	192.168.2.3	0x2023	No error (0)	i-32.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:43.757728100 CET	8.8.8.8	192.168.2.3	0x2023	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:43.757728100 CET	8.8.8.8	192.168.2.3	0x2023	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.757728100 CET	8.8.8.8	192.168.2.3	0x2023	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.757728100 CET	8.8.8.8	192.168.2.3	0x2023	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.757728100 CET	8.8.8.8	192.168.2.3	0x2023	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.757728100 CET	8.8.8.8	192.168.2.3	0x2023	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.757728100 CET	8.8.8.8	192.168.2.3	0x2023	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.757728100 CET	8.8.8.8	192.168.2.3	0x2023	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:43.757728100 CET	8.8.8.8	192.168.2.3	0x2023	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:44.267920971 CET	8.8.8.8	192.168.2.3	0x47f6	No error (0)	i-49.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:44.267920971 CET	8.8.8.8	192.168.2.3	0x47f6	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:44.267920971 CET	8.8.8.8	192.168.2.3	0x47f6	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:44.267920971 CET	8.8.8.8	192.168.2.3	0x47f6	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:44.267920971 CET	8.8.8.8	192.168.2.3	0x47f6	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:44.267920971 CET	8.8.8.8	192.168.2.3	0x47f6	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:44.267920971 CET	8.8.8.8	192.168.2.3	0x47f6	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:44.267920971 CET	8.8.8.8	192.168.2.3	0x47f6	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:44.267920971 CET	8.8.8.8	192.168.2.3	0x47f6	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:44.267920971 CET	8.8.8.8	192.168.2.3	0x47f6	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:54.613215923 CET	8.8.8.8	192.168.2.3	0x2730	No error (0)	i-20.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:54.613215923 CET	8.8.8.8	192.168.2.3	0x2730	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:54.613215923 CET	8.8.8.8	192.168.2.3	0x2730	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:54.613215923 CET	8.8.8.8	192.168.2.3	0x2730	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:54.613215923 CET	8.8.8.8	192.168.2.3	0x2730	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:54.613215923 CET	8.8.8.8	192.168.2.3	0x2730	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:54.613215923 CET	8.8.8.8	192.168.2.3	0x2730	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:54.613215923 CET	8.8.8.8	192.168.2.3	0x2730	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:54.613215923 CET	8.8.8.8	192.168.2.3	0x2730	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:54.613215923 CET	8.8.8.8	192.168.2.3	0x2730	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:56.019963026 CET	8.8.8.8	192.168.2.3	0x15e9	No error (0)	i-38.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:56.019963026 CET	8.8.8.8	192.168.2.3	0x15e9	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:56.019963026 CET	8.8.8.8	192.168.2.3	0x15e9	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:56.019963026 CET	8.8.8.8	192.168.2.3	0x15e9	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:56.019963026 CET	8.8.8.8	192.168.2.3	0x15e9	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:56.019963026 CET	8.8.8.8	192.168.2.3	0x15e9	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:56.019963026 CET	8.8.8.8	192.168.2.3	0x15e9	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:56.019963026 CET	8.8.8.8	192.168.2.3	0x15e9	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:56.019963026 CET	8.8.8.8	192.168.2.3	0x15e9	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:56.019963026 CET	8.8.8.8	192.168.2.3	0x15e9	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:56.582144976 CET	8.8.8.8	192.168.2.3	0x7860	No error (0)	cdn.ap.bittorrent.com	bittorrent-1.hs.llnwd.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:56.582144976 CET	8.8.8.8	192.168.2.3	0x7860	No error (0)	bittorrent-1.hs.llnwd.net		178.79.242.147	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.014291048 CET	8.8.8.8	192.168.2.3	0x18ee	No error (0)	cdn.bitmedianetwork.com	bittorrent-2.hs.llnwd.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:57.014291048 CET	8.8.8.8	192.168.2.3	0x18ee	No error (0)	bittorrent-2.hs.llnwd.net		178.79.242.181	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.014291048 CET	8.8.8.8	192.168.2.3	0x18ee	No error (0)	bittorrent-2.hs.llnwd.net		178.79.242.16	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.377742052 CET	8.8.8.8	192.168.2.3	0x9326	No error (0)	i-64.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:57.377742052 CET	8.8.8.8	192.168.2.3	0x9326	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:57.377742052 CET	8.8.8.8	192.168.2.3	0x9326	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.377742052 CET	8.8.8.8	192.168.2.3	0x9326	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.377742052 CET	8.8.8.8	192.168.2.3	0x9326	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.377742052 CET	8.8.8.8	192.168.2.3	0x9326	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.377742052 CET	8.8.8.8	192.168.2.3	0x9326	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.377742052 CET	8.8.8.8	192.168.2.3	0x9326	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.377742052 CET	8.8.8.8	192.168.2.3	0x9326	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.377742052 CET	8.8.8.8	192.168.2.3	0x9326	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.716604948 CET	8.8.8.8	192.168.2.3	0x6925	No error (0)	i-62.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:57.716604948 CET	8.8.8.8	192.168.2.3	0x6925	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:57.716604948 CET	8.8.8.8	192.168.2.3	0x6925	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.716604948 CET	8.8.8.8	192.168.2.3	0x6925	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.716604948 CET	8.8.8.8	192.168.2.3	0x6925	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.716604948 CET	8.8.8.8	192.168.2.3	0x6925	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.716604948 CET	8.8.8.8	192.168.2.3	0x6925	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.716604948 CET	8.8.8.8	192.168.2.3	0x6925	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.716604948 CET	8.8.8.8	192.168.2.3	0x6925	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:57.716604948 CET	8.8.8.8	192.168.2.3	0x6925	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.038413048 CET	8.8.8.8	192.168.2.3	0xeb6a	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:58.038413048 CET	8.8.8.8	192.168.2.3	0xeb6a	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:58.038413048 CET	8.8.8.8	192.168.2.3	0xeb6a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.038413048 CET	8.8.8.8	192.168.2.3	0xeb6a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.038413048 CET	8.8.8.8	192.168.2.3	0xeb6a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.038413048 CET	8.8.8.8	192.168.2.3	0xeb6a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.038413048 CET	8.8.8.8	192.168.2.3	0xeb6a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.038413048 CET	8.8.8.8	192.168.2.3	0xeb6a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.038413048 CET	8.8.8.8	192.168.2.3	0xeb6a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.038413048 CET	8.8.8.8	192.168.2.3	0xeb6a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.149122000 CET	8.8.8.8	192.168.2.3	0x585	No error (0)	i-1006.b-0.ad.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:58.149122000 CET	8.8.8.8	192.168.2.3	0x585	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:58.149122000 CET	8.8.8.8	192.168.2.3	0x585	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.149122000 CET	8.8.8.8	192.168.2.3	0x585	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.149122000 CET	8.8.8.8	192.168.2.3	0x585	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.149122000 CET	8.8.8.8	192.168.2.3	0x585	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.149122000 CET	8.8.8.8	192.168.2.3	0x585	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.149122000 CET	8.8.8.8	192.168.2.3	0x585	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.149122000 CET	8.8.8.8	192.168.2.3	0x585	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.149122000 CET	8.8.8.8	192.168.2.3	0x585	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.303916931 CET	8.8.8.8	192.168.2.3	0x26b7	No error (0)	utorrent.com		98.143.146.7	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.367811918 CET	8.8.8.8	192.168.2.3	0xfab7	No error (0)	i-38.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:58.367811918 CET	8.8.8.8	192.168.2.3	0xfab7	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:58.367811918 CET	8.8.8.8	192.168.2.3	0xfab7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.367811918 CET	8.8.8.8	192.168.2.3	0xfab7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.367811918 CET	8.8.8.8	192.168.2.3	0xfab7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.367811918 CET	8.8.8.8	192.168.2.3	0xfab7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.367811918 CET	8.8.8.8	192.168.2.3	0xfab7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.367811918 CET	8.8.8.8	192.168.2.3	0xfab7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.367811918 CET	8.8.8.8	192.168.2.3	0xfab7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.367811918 CET	8.8.8.8	192.168.2.3	0xfab7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.452511072 CET	8.8.8.8	192.168.2.3	0xd8ab	Name error (3)	engine.bitmedianetwork.com	none	none	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.694819927 CET	8.8.8.8	192.168.2.3	0x12d	No error (0)	i-62.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:58.694819927 CET	8.8.8.8	192.168.2.3	0x12d	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:58.694819927 CET	8.8.8.8	192.168.2.3	0x12d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.694819927 CET	8.8.8.8	192.168.2.3	0x12d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.694819927 CET	8.8.8.8	192.168.2.3	0x12d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.694819927 CET	8.8.8.8	192.168.2.3	0x12d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.694819927 CET	8.8.8.8	192.168.2.3	0x12d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.694819927 CET	8.8.8.8	192.168.2.3	0x12d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.694819927 CET	8.8.8.8	192.168.2.3	0x12d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:58.694819927 CET	8.8.8.8	192.168.2.3	0x12d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.039278030 CET	8.8.8.8	192.168.2.3	0xd00a	No error (0)	i-67.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:59.039278030 CET	8.8.8.8	192.168.2.3	0xd00a	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:59.039278030 CET	8.8.8.8	192.168.2.3	0xd00a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.039278030 CET	8.8.8.8	192.168.2.3	0xd00a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.039278030 CET	8.8.8.8	192.168.2.3	0xd00a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.039278030 CET	8.8.8.8	192.168.2.3	0xd00a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.039278030 CET	8.8.8.8	192.168.2.3	0xd00a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.039278030 CET	8.8.8.8	192.168.2.3	0xd00a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.039278030 CET	8.8.8.8	192.168.2.3	0xd00a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.039278030 CET	8.8.8.8	192.168.2.3	0xd00a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.693614006 CET	8.8.8.8	192.168.2.3	0xe160	No error (0)	i-62.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:59.693614006 CET	8.8.8.8	192.168.2.3	0xe160	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:50:59.693614006 CET	8.8.8.8	192.168.2.3	0xe160	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.693614006 CET	8.8.8.8	192.168.2.3	0xe160	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.693614006 CET	8.8.8.8	192.168.2.3	0xe160	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.693614006 CET	8.8.8.8	192.168.2.3	0xe160	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.693614006 CET	8.8.8.8	192.168.2.3	0xe160	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.693614006 CET	8.8.8.8	192.168.2.3	0xe160	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.693614006 CET	8.8.8.8	192.168.2.3	0xe160	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:50:59.693614006 CET	8.8.8.8	192.168.2.3	0xe160	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.071913004 CET	8.8.8.8	192.168.2.3	0x5a1	No error (0)	utorrent.com		98.143.146.7	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.244450092 CET	8.8.8.8	192.168.2.3	0xf9c	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:00.244450092 CET	8.8.8.8	192.168.2.3	0xf9c	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:00.244450092 CET	8.8.8.8	192.168.2.3	0xf9c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.244450092 CET	8.8.8.8	192.168.2.3	0xf9c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.244450092 CET	8.8.8.8	192.168.2.3	0xf9c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.244450092 CET	8.8.8.8	192.168.2.3	0xf9c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.244450092 CET	8.8.8.8	192.168.2.3	0xf9c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.244450092 CET	8.8.8.8	192.168.2.3	0xf9c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.244450092 CET	8.8.8.8	192.168.2.3	0xf9c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.244450092 CET	8.8.8.8	192.168.2.3	0xf9c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.569412947 CET	8.8.8.8	192.168.2.3	0x469e	No error (0)	www.utorrent.com	bittorrent-4.hs.llnwd.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:00.569412947 CET	8.8.8.8	192.168.2.3	0x469e	No error (0)	bittorrent-4.hs.llnwd.net		178.79.242.16	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.569412947 CET	8.8.8.8	192.168.2.3	0x469e	No error (0)	bittorrent-4.hs.llnwd.net		178.79.242.181	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.634735107 CET	8.8.8.8	192.168.2.3	0xd9f3	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:00.634735107 CET	8.8.8.8	192.168.2.3	0xd9f3	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:00.634735107 CET	8.8.8.8	192.168.2.3	0xd9f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.634735107 CET	8.8.8.8	192.168.2.3	0xd9f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.634735107 CET	8.8.8.8	192.168.2.3	0xd9f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.634735107 CET	8.8.8.8	192.168.2.3	0xd9f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.634735107 CET	8.8.8.8	192.168.2.3	0xd9f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.634735107 CET	8.8.8.8	192.168.2.3	0xd9f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.634735107 CET	8.8.8.8	192.168.2.3	0xd9f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:00.634735107 CET	8.8.8.8	192.168.2.3	0xd9f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.154905081 CET	8.8.8.8	192.168.2.3	0x6c61	No error (0)	i-38.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:01.154905081 CET	8.8.8.8	192.168.2.3	0x6c61	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:01.154905081 CET	8.8.8.8	192.168.2.3	0x6c61	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.154905081 CET	8.8.8.8	192.168.2.3	0x6c61	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.154905081 CET	8.8.8.8	192.168.2.3	0x6c61	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.154905081 CET	8.8.8.8	192.168.2.3	0x6c61	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.154905081 CET	8.8.8.8	192.168.2.3	0x6c61	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.154905081 CET	8.8.8.8	192.168.2.3	0x6c61	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.154905081 CET	8.8.8.8	192.168.2.3	0x6c61	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.154905081 CET	8.8.8.8	192.168.2.3	0x6c61	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.183602095 CET	8.8.8.8	192.168.2.3	0xbc1f	No error (0)	sdk.privacy-center.org		99.86.154.93	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.183602095 CET	8.8.8.8	192.168.2.3	0xbc1f	No error (0)	sdk.privacy-center.org		99.86.154.70	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.183602095 CET	8.8.8.8	192.168.2.3	0xbc1f	No error (0)	sdk.privacy-center.org		99.86.154.64	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.183602095 CET	8.8.8.8	192.168.2.3	0xbc1f	No error (0)	sdk.privacy-center.org		99.86.154.118	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.233633041 CET	8.8.8.8	192.168.2.3	0xd246	No error (0)	cdn.optimizely.com	cdn.o6.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:01.348912001 CET	8.8.8.8	192.168.2.3	0x8680	No error (0)	www.bt.co	www.bt.co.s3-website-us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:01.348912001 CET	8.8.8.8	192.168.2.3	0x8680	No error (0)	www.bt.co.s3-website-us-east-1.amazonaws.com	s3-website-us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:01.348912001 CET	8.8.8.8	192.168.2.3	0x8680	No error (0)	s3-website-us-east-1.amazonaws.com		52.217.98.3	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.379023075 CET	8.8.8.8	192.168.2.3	0x5ce8	No error (0)	secure.quantserve.com	2kpixel.quantserve.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:01.379023075 CET	8.8.8.8	192.168.2.3	0x5ce8	No error (0)	2kpixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:01.379023075 CET	8.8.8.8	192.168.2.3	0x5ce8	No error (0)	global.px.quantserve.com		91.228.74.189	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.379023075 CET	8.8.8.8	192.168.2.3	0x5ce8	No error (0)	global.px.quantserve.com		91.228.74.133	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.379023075 CET	8.8.8.8	192.168.2.3	0x5ce8	No error (0)	global.px.quantserve.com		91.228.74.226	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.379023075 CET	8.8.8.8	192.168.2.3	0x5ce8	No error (0)	global.px.quantserve.com		91.228.74.134	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:01.379023075 CET	8.8.8.8	192.168.2.3	0x5ce8	No error (0)	global.px.quantserve.com		91.228.74.198	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.248943090 CET	8.8.8.8	192.168.2.3	0x6d0f	No error (0)	video.trontv.com	bittorrent-4.hs.llnwd.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:02.248943090 CET	8.8.8.8	192.168.2.3	0x6d0f	No error (0)	bittorrent-4.hs.llnwd.net		178.79.242.16	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.248943090 CET	8.8.8.8	192.168.2.3	0x6d0f	No error (0)	bittorrent-4.hs.llnwd.net		178.79.242.181	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.396023989 CET	8.8.8.8	192.168.2.3	0xf200	No error (0)	cdn-assets.bittorrent.com	d30v41vhco8ky9.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:02.396023989 CET	8.8.8.8	192.168.2.3	0xf200	No error (0)	d30v41vhco8ky9.cloudfront.net		13.226.169.128	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.396023989 CET	8.8.8.8	192.168.2.3	0xf200	No error (0)	d30v41vhco8ky9.cloudfront.net		13.226.169.18	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.396023989 CET	8.8.8.8	192.168.2.3	0xf200	No error (0)	d30v41vhco8ky9.cloudfront.net		13.226.169.78	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.396023989 CET	8.8.8.8	192.168.2.3	0xf200	No error (0)	d30v41vhco8ky9.cloudfront.net		13.226.169.115	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.416579008 CET	8.8.8.8	192.168.2.3	0x99af	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:02.416579008 CET	8.8.8.8	192.168.2.3	0x99af	No error (0)	stats.l.doubleclick.net		108.177.127.155	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.416579008 CET	8.8.8.8	192.168.2.3	0x99af	No error (0)	stats.l.doubleclick.net		108.177.127.156	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.416579008 CET	8.8.8.8	192.168.2.3	0x99af	No error (0)	stats.l.doubleclick.net		108.177.127.157	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.416579008 CET	8.8.8.8	192.168.2.3	0x99af	No error (0)	stats.l.doubleclick.net		108.177.127.154	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.520191908 CET	8.8.8.8	192.168.2.3	0x583b	No error (0)	s.zkcdn.net		13.226.169.14	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.520191908 CET	8.8.8.8	192.168.2.3	0x583b	No error (0)	s.zkcdn.net		13.226.169.18	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.520191908 CET	8.8.8.8	192.168.2.3	0x583b	No error (0)	s.zkcdn.net		13.226.169.21	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.520191908 CET	8.8.8.8	192.168.2.3	0x583b	No error (0)	s.zkcdn.net		13.226.169.42	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:02.531044960 CET	8.8.8.8	192.168.2.3	0x2591	No error (0)	ssum.casalemedia.com	ssum.casalemedia.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:02.739417076 CET	8.8.8.8	192.168.2.3	0x599d	No error (0)	cdn3.optimizely.com	cdn.optimizely.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:02.857218981 CET	8.8.8.8	192.168.2.3	0xcbce	No error (0)	50136351.log.optimizely.com	log.optimizely.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:02.857218981 CET	8.8.8.8	192.168.2.3	0xcbce	No error (0)	log.optimizely.com	prod-classic-log-1849103161.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:02.857218981 CET	8.8.8.8	192.168.2.3	0xcbce	No error (0)	prod-classic-log-1849103161.us-east-1.elb.amazonaws.com		3.214.78.220	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:03.745161057 CET	8.8.8.8	192.168.2.3	0x801	No error (0)	a8230037.cdn.optimizely.com	wildcard.cdn.optimizely.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:03.920555115 CET	8.8.8.8	192.168.2.3	0x16c8	No error (0)	static.ads-twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:03.920555115 CET	8.8.8.8	192.168.2.3	0x16c8	No error (0)	platform.twitter.map.fastly.net		151.101.12.157	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.036355972 CET	8.8.8.8	192.168.2.3	0x304a	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:04.036355972 CET	8.8.8.8	192.168.2.3	0x304a	No error (0)	scontent.xx.fbcdn.net		31.13.92.14	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.600513935 CET	8.8.8.8	192.168.2.3	0x9124	No error (0)	video.trontv.com	bittorrent-4.hs.llnwd.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:04.600513935 CET	8.8.8.8	192.168.2.3	0x9124	No error (0)	bittorrent-4.hs.llnwd.net		178.79.242.181	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.600513935 CET	8.8.8.8	192.168.2.3	0x9124	No error (0)	bittorrent-4.hs.llnwd.net		178.79.242.16	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.642045975 CET	8.8.8.8	192.168.2.3	0x37ae	No error (0)	code.jquery.com	cds.s5x3j6q5.hwcdn.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:04.728821993 CET	8.8.8.8	192.168.2.3	0x44d	No error (0)	logx.optimizely.com	p13nlog-1106815646.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:04.728821993 CET	8.8.8.8	192.168.2.3	0x44d	No error (0)	p13nlog-1106815646.us-east-1.elb.amazonaws.com		54.208.194.17	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.728821993 CET	8.8.8.8	192.168.2.3	0x44d	No error (0)	p13nlog-1106815646.us-east-1.elb.amazonaws.com		52.22.195.165	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.728821993 CET	8.8.8.8	192.168.2.3	0x44d	No error (0)	p13nlog-1106815646.us-east-1.elb.amazonaws.com		52.55.162.201	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.728821993 CET	8.8.8.8	192.168.2.3	0x44d	No error (0)	p13nlog-1106815646.us-east-1.elb.amazonaws.com		3.218.11.80	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.728821993 CET	8.8.8.8	192.168.2.3	0x44d	No error (0)	p13nlog-1106815646.us-east-1.elb.amazonaws.com		3.220.69.124	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.728821993 CET	8.8.8.8	192.168.2.3	0x44d	No error (0)	p13nlog-1106815646.us-east-1.elb.amazonaws.com		3.227.150.155	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.728821993 CET	8.8.8.8	192.168.2.3	0x44d	No error (0)	p13nlog-1106815646.us-east-1.elb.amazonaws.com		54.210.71.80	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.728821993 CET	8.8.8.8	192.168.2.3	0x44d	No error (0)	p13nlog-1106815646.us-east-1.elb.amazonaws.com		34.225.216.136	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.827498913 CET	8.8.8.8	192.168.2.3	0xf6ad	No error (0)	update.utorrent.com		67.215.246.203	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.913878918 CET	8.8.8.8	192.168.2.3	0x1f03	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:04.913878918 CET	8.8.8.8	192.168.2.3	0x1f03	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:04.913878918 CET	8.8.8.8	192.168.2.3	0x1f03	No error (0)	s.twitter.com		104.244.42.131	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.913878918 CET	8.8.8.8	192.168.2.3	0x1f03	No error (0)	s.twitter.com		104.244.42.195	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.913878918 CET	8.8.8.8	192.168.2.3	0x1f03	No error (0)	s.twitter.com		104.244.42.67	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:04.913878918 CET	8.8.8.8	192.168.2.3	0x1f03	No error (0)	s.twitter.com		104.244.42.3	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.072035074 CET	8.8.8.8	192.168.2.3	0x50b3	No error (0)	t.co		104.244.42.69	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.072035074 CET	8.8.8.8	192.168.2.3	0x50b3	No error (0)	t.co		104.244.42.133	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.072035074 CET	8.8.8.8	192.168.2.3	0x50b3	No error (0)	t.co		104.244.42.5	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.072035074 CET	8.8.8.8	192.168.2.3	0x50b3	No error (0)	t.co		104.244.42.197	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.355566978 CET	8.8.8.8	192.168.2.3	0xe87f	No error (0)	media.adaware.com		104.16.236.79	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.355566978 CET	8.8.8.8	192.168.2.3	0xe87f	No error (0)	media.adaware.com		104.16.235.79	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.543080091 CET	8.8.8.8	192.168.2.3	0xaa31	No error (0)	btinstall-artifacts.bittorrent.com	bittorrent-4.hs.llnwd.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:05.543080091 CET	8.8.8.8	192.168.2.3	0xaa31	No error (0)	bittorrent-4.hs.llnwd.net		178.79.242.181	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.543080091 CET	8.8.8.8	192.168.2.3	0xaa31	No error (0)	bittorrent-4.hs.llnwd.net		178.79.242.16	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.570483923 CET	8.8.8.8	192.168.2.3	0xcab5	No error (0)	sdk.privacy-center.org		99.86.154.93	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.570483923 CET	8.8.8.8	192.168.2.3	0xcab5	No error (0)	sdk.privacy-center.org		99.86.154.70	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.570483923 CET	8.8.8.8	192.168.2.3	0xcab5	No error (0)	sdk.privacy-center.org		99.86.154.118	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:05.570483923 CET	8.8.8.8	192.168.2.3	0xcab5	No error (0)	sdk.privacy-center.org		99.86.154.64	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:09.168708086 CET	8.8.8.8	192.168.2.3	0x11af	No error (0)	sdk.privacy-center.org		99.86.154.93	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:09.168708086 CET	8.8.8.8	192.168.2.3	0x11af	No error (0)	sdk.privacy-center.org		99.86.154.70	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:09.168708086 CET	8.8.8.8	192.168.2.3	0x11af	No error (0)	sdk.privacy-center.org		99.86.154.118	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:09.168708086 CET	8.8.8.8	192.168.2.3	0x11af	No error (0)	sdk.privacy-center.org		99.86.154.64	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.135123014 CET	8.8.8.8	192.168.2.3	0x2939	No error (0)	i-1006.b-0.ad.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:10.135123014 CET	8.8.8.8	192.168.2.3	0x2939	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:10.135123014 CET	8.8.8.8	192.168.2.3	0x2939	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.135123014 CET	8.8.8.8	192.168.2.3	0x2939	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.135123014 CET	8.8.8.8	192.168.2.3	0x2939	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.135123014 CET	8.8.8.8	192.168.2.3	0x2939	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.135123014 CET	8.8.8.8	192.168.2.3	0x2939	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.135123014 CET	8.8.8.8	192.168.2.3	0x2939	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.135123014 CET	8.8.8.8	192.168.2.3	0x2939	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.135123014 CET	8.8.8.8	192.168.2.3	0x2939	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.174165010 CET	8.8.8.8	192.168.2.3	0x7577	No error (0)	www9.smartadserver.com	tmk-eqx-geoloc.smartadserver.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:10.174165010 CET	8.8.8.8	192.168.2.3	0x7577	No error (0)	tmk-eqx-geoloc.smartadserver.com	2-01-275d-0018.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:10.174165010 CET	8.8.8.8	192.168.2.3	0x7577	No error (0)	eqx.smartadserver.com		185.86.137.113	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.174165010 CET	8.8.8.8	192.168.2.3	0x7577	No error (0)	eqx.smartadserver.com		185.86.137.17	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.174165010 CET	8.8.8.8	192.168.2.3	0x7577	No error (0)	eqx.smartadserver.com		185.86.137.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:10.174165010 CET	8.8.8.8	192.168.2.3	0x7577	No error (0)	eqx.smartadserver.com		185.86.137.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:11.328094959 CET	8.8.8.8	192.168.2.3	0x80c7	No error (0)	utclient.utorrent.com	d2adxpv8ev13tq.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:11.328094959 CET	8.8.8.8	192.168.2.3	0x80c7	No error (0)	d2adxpv8ev13tq.cloudfront.net		13.226.169.10	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:11.328094959 CET	8.8.8.8	192.168.2.3	0x80c7	No error (0)	d2adxpv8ev13tq.cloudfront.net		13.226.169.41	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:11.328094959 CET	8.8.8.8	192.168.2.3	0x80c7	No error (0)	d2adxpv8ev13tq.cloudfront.net		13.226.169.78	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:11.328094959 CET	8.8.8.8	192.168.2.3	0x80c7	No error (0)	d2adxpv8ev13tq.cloudfront.net		13.226.169.4	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:15.879215002 CET	8.8.8.8	192.168.2.3	0xcd36	No error (0)	i-3100.b-0.ad.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:15.879215002 CET	8.8.8.8	192.168.2.3	0xcd36	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:15.879215002 CET	8.8.8.8	192.168.2.3	0xcd36	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:15.879215002 CET	8.8.8.8	192.168.2.3	0xcd36	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:15.879215002 CET	8.8.8.8	192.168.2.3	0xcd36	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:15.879215002 CET	8.8.8.8	192.168.2.3	0xcd36	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:15.879215002 CET	8.8.8.8	192.168.2.3	0xcd36	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:15.879215002 CET	8.8.8.8	192.168.2.3	0xcd36	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:15.879215002 CET	8.8.8.8	192.168.2.3	0xcd36	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:15.879215002 CET	8.8.8.8	192.168.2.3	0xcd36	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:19.220587015 CET	8.8.8.8	192.168.2.3	0x107b	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:19.220587015 CET	8.8.8.8	192.168.2.3	0x107b	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:19.220587015 CET	8.8.8.8	192.168.2.3	0x107b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:19.220587015 CET	8.8.8.8	192.168.2.3	0x107b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:19.220587015 CET	8.8.8.8	192.168.2.3	0x107b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:19.220587015 CET	8.8.8.8	192.168.2.3	0x107b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:19.220587015 CET	8.8.8.8	192.168.2.3	0x107b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:19.220587015 CET	8.8.8.8	192.168.2.3	0x107b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:19.220587015 CET	8.8.8.8	192.168.2.3	0x107b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:19.220587015 CET	8.8.8.8	192.168.2.3	0x107b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:26.452094078 CET	8.8.8.8	192.168.2.3	0x98eb	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:26.452094078 CET	8.8.8.8	192.168.2.3	0x98eb	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:26.452094078 CET	8.8.8.8	192.168.2.3	0x98eb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:26.452094078 CET	8.8.8.8	192.168.2.3	0x98eb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:26.452094078 CET	8.8.8.8	192.168.2.3	0x98eb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:26.452094078 CET	8.8.8.8	192.168.2.3	0x98eb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:26.452094078 CET	8.8.8.8	192.168.2.3	0x98eb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:26.452094078 CET	8.8.8.8	192.168.2.3	0x98eb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:26.452094078 CET	8.8.8.8	192.168.2.3	0x98eb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:26.452094078 CET	8.8.8.8	192.168.2.3	0x98eb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:27.855547905 CET	8.8.8.8	192.168.2.3	0xc227	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:27.855547905 CET	8.8.8.8	192.168.2.3	0xc227	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:27.855547905 CET	8.8.8.8	192.168.2.3	0xc227	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:27.855547905 CET	8.8.8.8	192.168.2.3	0xc227	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:27.855547905 CET	8.8.8.8	192.168.2.3	0xc227	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:27.855547905 CET	8.8.8.8	192.168.2.3	0xc227	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:27.855547905 CET	8.8.8.8	192.168.2.3	0xc227	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:27.855547905 CET	8.8.8.8	192.168.2.3	0xc227	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:27.855547905 CET	8.8.8.8	192.168.2.3	0xc227	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:27.855547905 CET	8.8.8.8	192.168.2.3	0xc227	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:28.544473886 CET	8.8.8.8	192.168.2.3	0xa2f0	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:28.544473886 CET	8.8.8.8	192.168.2.3	0xa2f0	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:28.544473886 CET	8.8.8.8	192.168.2.3	0xa2f0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:28.544473886 CET	8.8.8.8	192.168.2.3	0xa2f0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:28.544473886 CET	8.8.8.8	192.168.2.3	0xa2f0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:28.544473886 CET	8.8.8.8	192.168.2.3	0xa2f0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:28.544473886 CET	8.8.8.8	192.168.2.3	0xa2f0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:28.544473886 CET	8.8.8.8	192.168.2.3	0xa2f0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:28.544473886 CET	8.8.8.8	192.168.2.3	0xa2f0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:28.544473886 CET	8.8.8.8	192.168.2.3	0xa2f0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.445441961 CET	8.8.8.8	192.168.2.3	0x2ec1	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:35.445441961 CET	8.8.8.8	192.168.2.3	0x2ec1	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:35.445441961 CET	8.8.8.8	192.168.2.3	0x2ec1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.445441961 CET	8.8.8.8	192.168.2.3	0x2ec1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.445441961 CET	8.8.8.8	192.168.2.3	0x2ec1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.445441961 CET	8.8.8.8	192.168.2.3	0x2ec1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.445441961 CET	8.8.8.8	192.168.2.3	0x2ec1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.445441961 CET	8.8.8.8	192.168.2.3	0x2ec1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.445441961 CET	8.8.8.8	192.168.2.3	0x2ec1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.445441961 CET	8.8.8.8	192.168.2.3	0x2ec1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.990618944 CET	8.8.8.8	192.168.2.3	0x777d	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:35.990618944 CET	8.8.8.8	192.168.2.3	0x777d	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:35.990618944 CET	8.8.8.8	192.168.2.3	0x777d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.990618944 CET	8.8.8.8	192.168.2.3	0x777d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.990618944 CET	8.8.8.8	192.168.2.3	0x777d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.990618944 CET	8.8.8.8	192.168.2.3	0x777d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.990618944 CET	8.8.8.8	192.168.2.3	0x777d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.990618944 CET	8.8.8.8	192.168.2.3	0x777d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.990618944 CET	8.8.8.8	192.168.2.3	0x777d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:35.990618944 CET	8.8.8.8	192.168.2.3	0x777d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.471436024 CET	8.8.8.8	192.168.2.3	0xf46c	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:36.471436024 CET	8.8.8.8	192.168.2.3	0xf46c	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:36.471436024 CET	8.8.8.8	192.168.2.3	0xf46c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.471436024 CET	8.8.8.8	192.168.2.3	0xf46c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.471436024 CET	8.8.8.8	192.168.2.3	0xf46c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.471436024 CET	8.8.8.8	192.168.2.3	0xf46c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.471436024 CET	8.8.8.8	192.168.2.3	0xf46c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.471436024 CET	8.8.8.8	192.168.2.3	0xf46c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.471436024 CET	8.8.8.8	192.168.2.3	0xf46c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.471436024 CET	8.8.8.8	192.168.2.3	0xf46c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.932073116 CET	8.8.8.8	192.168.2.3	0x9a67	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:36.932073116 CET	8.8.8.8	192.168.2.3	0x9a67	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:36.932073116 CET	8.8.8.8	192.168.2.3	0x9a67	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.932073116 CET	8.8.8.8	192.168.2.3	0x9a67	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.932073116 CET	8.8.8.8	192.168.2.3	0x9a67	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.932073116 CET	8.8.8.8	192.168.2.3	0x9a67	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.932073116 CET	8.8.8.8	192.168.2.3	0x9a67	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.932073116 CET	8.8.8.8	192.168.2.3	0x9a67	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.932073116 CET	8.8.8.8	192.168.2.3	0x9a67	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:36.932073116 CET	8.8.8.8	192.168.2.3	0x9a67	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.207457066 CET	8.8.8.8	192.168.2.3	0xacd1	No error (0)	i-61.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:40.207457066 CET	8.8.8.8	192.168.2.3	0xacd1	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:40.207457066 CET	8.8.8.8	192.168.2.3	0xacd1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.113.215	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.207457066 CET	8.8.8.8	192.168.2.3	0xacd1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.207457066 CET	8.8.8.8	192.168.2.3	0xacd1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.207457066 CET	8.8.8.8	192.168.2.3	0xacd1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.207457066 CET	8.8.8.8	192.168.2.3	0xacd1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.207457066 CET	8.8.8.8	192.168.2.3	0xacd1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.207457066 CET	8.8.8.8	192.168.2.3	0xacd1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.207457066 CET	8.8.8.8	192.168.2.3	0xacd1	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.539268017 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:40.539268017 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:40.539268017 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.539268017 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.539268017 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.539268017 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.539268017 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.539268017 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.539268017 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.539268017 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.880886078 CET	8.8.8.8	192.168.2.3	0xa4df	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:40.880886078 CET	8.8.8.8	192.168.2.3	0xa4df	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:40.880886078 CET	8.8.8.8	192.168.2.3	0xa4df	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.880886078 CET	8.8.8.8	192.168.2.3	0xa4df	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.880886078 CET	8.8.8.8	192.168.2.3	0xa4df	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.880886078 CET	8.8.8.8	192.168.2.3	0xa4df	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.880886078 CET	8.8.8.8	192.168.2.3	0xa4df	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.880886078 CET	8.8.8.8	192.168.2.3	0xa4df	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.880886078 CET	8.8.8.8	192.168.2.3	0xa4df	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:40.880886078 CET	8.8.8.8	192.168.2.3	0xa4df	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:42.382811069 CET	8.8.8.8	192.168.2.3	0xd3f3	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:42.382811069 CET	8.8.8.8	192.168.2.3	0xd3f3	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:42.382811069 CET	8.8.8.8	192.168.2.3	0xd3f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:42.382811069 CET	8.8.8.8	192.168.2.3	0xd3f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:42.382811069 CET	8.8.8.8	192.168.2.3	0xd3f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:42.382811069 CET	8.8.8.8	192.168.2.3	0xd3f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:42.382811069 CET	8.8.8.8	192.168.2.3	0xd3f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:42.382811069 CET	8.8.8.8	192.168.2.3	0xd3f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:42.382811069 CET	8.8.8.8	192.168.2.3	0xd3f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:42.382811069 CET	8.8.8.8	192.168.2.3	0xd3f3	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.026860952 CET	8.8.8.8	192.168.2.3	0x4a2b	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:43.026860952 CET	8.8.8.8	192.168.2.3	0x4a2b	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:43.026860952 CET	8.8.8.8	192.168.2.3	0x4a2b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.217.194	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.026860952 CET	8.8.8.8	192.168.2.3	0x4a2b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.026860952 CET	8.8.8.8	192.168.2.3	0x4a2b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.215.82	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.026860952 CET	8.8.8.8	192.168.2.3	0x4a2b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.026860952 CET	8.8.8.8	192.168.2.3	0x4a2b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.026860952 CET	8.8.8.8	192.168.2.3	0x4a2b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.026860952 CET	8.8.8.8	192.168.2.3	0x4a2b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.026860952 CET	8.8.8.8	192.168.2.3	0x4a2b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.340665102 CET	8.8.8.8	192.168.2.3	0xba32	No error (0)	i-64.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:43.340665102 CET	8.8.8.8	192.168.2.3	0xba32	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:43.340665102 CET	8.8.8.8	192.168.2.3	0xba32	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.340665102 CET	8.8.8.8	192.168.2.3	0xba32	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.92.252	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.340665102 CET	8.8.8.8	192.168.2.3	0xba32	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.340665102 CET	8.8.8.8	192.168.2.3	0xba32	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.340665102 CET	8.8.8.8	192.168.2.3	0xba32	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.340665102 CET	8.8.8.8	192.168.2.3	0xba32	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.221.32	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.340665102 CET	8.8.8.8	192.168.2.3	0xba32	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.340665102 CET	8.8.8.8	192.168.2.3	0xba32	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.661741018 CET	8.8.8.8	192.168.2.3	0xb36c	No error (0)	i-61.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:43.661741018 CET	8.8.8.8	192.168.2.3	0xb36c	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:43.661741018 CET	8.8.8.8	192.168.2.3	0xb36c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.217.194	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.661741018 CET	8.8.8.8	192.168.2.3	0xb36c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.661741018 CET	8.8.8.8	192.168.2.3	0xb36c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.215.82	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.661741018 CET	8.8.8.8	192.168.2.3	0xb36c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.661741018 CET	8.8.8.8	192.168.2.3	0xb36c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.661741018 CET	8.8.8.8	192.168.2.3	0xb36c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.661741018 CET	8.8.8.8	192.168.2.3	0xb36c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:43.661741018 CET	8.8.8.8	192.168.2.3	0xb36c	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.004060030 CET	8.8.8.8	192.168.2.3	0x1e29	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:44.004060030 CET	8.8.8.8	192.168.2.3	0x1e29	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:44.004060030 CET	8.8.8.8	192.168.2.3	0x1e29	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.217.194	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.004060030 CET	8.8.8.8	192.168.2.3	0x1e29	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.004060030 CET	8.8.8.8	192.168.2.3	0x1e29	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.215.82	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.004060030 CET	8.8.8.8	192.168.2.3	0x1e29	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.004060030 CET	8.8.8.8	192.168.2.3	0x1e29	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.004060030 CET	8.8.8.8	192.168.2.3	0x1e29	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.004060030 CET	8.8.8.8	192.168.2.3	0x1e29	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.004060030 CET	8.8.8.8	192.168.2.3	0x1e29	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.340055943 CET	8.8.8.8	192.168.2.3	0xf1cf	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:44.340055943 CET	8.8.8.8	192.168.2.3	0xf1cf	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:44.340055943 CET	8.8.8.8	192.168.2.3	0xf1cf	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.340055943 CET	8.8.8.8	192.168.2.3	0xf1cf	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.340055943 CET	8.8.8.8	192.168.2.3	0xf1cf	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.340055943 CET	8.8.8.8	192.168.2.3	0xf1cf	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.340055943 CET	8.8.8.8	192.168.2.3	0xf1cf	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.340055943 CET	8.8.8.8	192.168.2.3	0xf1cf	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.340055943 CET	8.8.8.8	192.168.2.3	0xf1cf	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.340055943 CET	8.8.8.8	192.168.2.3	0xf1cf	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.665760994 CET	8.8.8.8	192.168.2.3	0x3bcb	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:44.665760994 CET	8.8.8.8	192.168.2.3	0x3bcb	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:44.665760994 CET	8.8.8.8	192.168.2.3	0x3bcb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.217.194	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.665760994 CET	8.8.8.8	192.168.2.3	0x3bcb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.665760994 CET	8.8.8.8	192.168.2.3	0x3bcb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.215.82	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.665760994 CET	8.8.8.8	192.168.2.3	0x3bcb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.665760994 CET	8.8.8.8	192.168.2.3	0x3bcb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.665760994 CET	8.8.8.8	192.168.2.3	0x3bcb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.665760994 CET	8.8.8.8	192.168.2.3	0x3bcb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:44.665760994 CET	8.8.8.8	192.168.2.3	0x3bcb	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.050019979 CET	8.8.8.8	192.168.2.3	0xb540	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:45.050019979 CET	8.8.8.8	192.168.2.3	0xb540	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:45.050019979 CET	8.8.8.8	192.168.2.3	0xb540	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.217.194	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.050019979 CET	8.8.8.8	192.168.2.3	0xb540	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.050019979 CET	8.8.8.8	192.168.2.3	0xb540	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.215.82	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.050019979 CET	8.8.8.8	192.168.2.3	0xb540	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.050019979 CET	8.8.8.8	192.168.2.3	0xb540	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.050019979 CET	8.8.8.8	192.168.2.3	0xb540	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.050019979 CET	8.8.8.8	192.168.2.3	0xb540	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.050019979 CET	8.8.8.8	192.168.2.3	0xb540	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.422096014 CET	8.8.8.8	192.168.2.3	0xbdda	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:45.422096014 CET	8.8.8.8	192.168.2.3	0xbdda	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:45.422096014 CET	8.8.8.8	192.168.2.3	0xbdda	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.217.194	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.422096014 CET	8.8.8.8	192.168.2.3	0xbdda	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.243.58.192	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.422096014 CET	8.8.8.8	192.168.2.3	0xbdda	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.215.82	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.422096014 CET	8.8.8.8	192.168.2.3	0xbdda	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.422096014 CET	8.8.8.8	192.168.2.3	0xbdda	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.23.85.1	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.422096014 CET	8.8.8.8	192.168.2.3	0xbdda	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.422096014 CET	8.8.8.8	192.168.2.3	0xbdda	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.197.251.114	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.422096014 CET	8.8.8.8	192.168.2.3	0xbdda	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.20.217.71	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.744059086 CET	8.8.8.8	192.168.2.3	0xd495	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:45.744059086 CET	8.8.8.8	192.168.2.3	0xd495	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:45.744059086 CET	8.8.8.8	192.168.2.3	0xd495	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.744059086 CET	8.8.8.8	192.168.2.3	0xd495	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.744059086 CET	8.8.8.8	192.168.2.3	0xd495	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.744059086 CET	8.8.8.8	192.168.2.3	0xd495	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.744059086 CET	8.8.8.8	192.168.2.3	0xd495	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.744059086 CET	8.8.8.8	192.168.2.3	0xd495	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.744059086 CET	8.8.8.8	192.168.2.3	0xd495	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:45.744059086 CET	8.8.8.8	192.168.2.3	0xd495	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.067178011 CET	8.8.8.8	192.168.2.3	0xd49d	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:46.067178011 CET	8.8.8.8	192.168.2.3	0xd49d	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:46.067178011 CET	8.8.8.8	192.168.2.3	0xd49d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.067178011 CET	8.8.8.8	192.168.2.3	0xd49d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.067178011 CET	8.8.8.8	192.168.2.3	0xd49d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.067178011 CET	8.8.8.8	192.168.2.3	0xd49d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.067178011 CET	8.8.8.8	192.168.2.3	0xd49d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.067178011 CET	8.8.8.8	192.168.2.3	0xd49d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.067178011 CET	8.8.8.8	192.168.2.3	0xd49d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.067178011 CET	8.8.8.8	192.168.2.3	0xd49d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.476651907 CET	8.8.8.8	192.168.2.3	0xf43b	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:46.476651907 CET	8.8.8.8	192.168.2.3	0xf43b	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:46.476651907 CET	8.8.8.8	192.168.2.3	0xf43b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.476651907 CET	8.8.8.8	192.168.2.3	0xf43b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.476651907 CET	8.8.8.8	192.168.2.3	0xf43b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.476651907 CET	8.8.8.8	192.168.2.3	0xf43b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.476651907 CET	8.8.8.8	192.168.2.3	0xf43b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.476651907 CET	8.8.8.8	192.168.2.3	0xf43b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.476651907 CET	8.8.8.8	192.168.2.3	0xf43b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.476651907 CET	8.8.8.8	192.168.2.3	0xf43b	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.818350077 CET	8.8.8.8	192.168.2.3	0x2306	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:46.818350077 CET	8.8.8.8	192.168.2.3	0x2306	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:46.818350077 CET	8.8.8.8	192.168.2.3	0x2306	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.818350077 CET	8.8.8.8	192.168.2.3	0x2306	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.818350077 CET	8.8.8.8	192.168.2.3	0x2306	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.818350077 CET	8.8.8.8	192.168.2.3	0x2306	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.818350077 CET	8.8.8.8	192.168.2.3	0x2306	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.818350077 CET	8.8.8.8	192.168.2.3	0x2306	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.818350077 CET	8.8.8.8	192.168.2.3	0x2306	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:46.818350077 CET	8.8.8.8	192.168.2.3	0x2306	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.277529955 CET	8.8.8.8	192.168.2.3	0x3cdc	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:47.277529955 CET	8.8.8.8	192.168.2.3	0x3cdc	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:47.277529955 CET	8.8.8.8	192.168.2.3	0x3cdc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.277529955 CET	8.8.8.8	192.168.2.3	0x3cdc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.277529955 CET	8.8.8.8	192.168.2.3	0x3cdc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.277529955 CET	8.8.8.8	192.168.2.3	0x3cdc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.277529955 CET	8.8.8.8	192.168.2.3	0x3cdc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.277529955 CET	8.8.8.8	192.168.2.3	0x3cdc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.277529955 CET	8.8.8.8	192.168.2.3	0x3cdc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.277529955 CET	8.8.8.8	192.168.2.3	0x3cdc	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.666987896 CET	8.8.8.8	192.168.2.3	0xeb10	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:47.666987896 CET	8.8.8.8	192.168.2.3	0xeb10	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:47.666987896 CET	8.8.8.8	192.168.2.3	0xeb10	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.666987896 CET	8.8.8.8	192.168.2.3	0xeb10	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.666987896 CET	8.8.8.8	192.168.2.3	0xeb10	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.666987896 CET	8.8.8.8	192.168.2.3	0xeb10	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.666987896 CET	8.8.8.8	192.168.2.3	0xeb10	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.666987896 CET	8.8.8.8	192.168.2.3	0xeb10	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.666987896 CET	8.8.8.8	192.168.2.3	0xeb10	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:47.666987896 CET	8.8.8.8	192.168.2.3	0xeb10	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.048152924 CET	8.8.8.8	192.168.2.3	0x279d	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:48.048152924 CET	8.8.8.8	192.168.2.3	0x279d	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:48.048152924 CET	8.8.8.8	192.168.2.3	0x279d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.048152924 CET	8.8.8.8	192.168.2.3	0x279d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.048152924 CET	8.8.8.8	192.168.2.3	0x279d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.048152924 CET	8.8.8.8	192.168.2.3	0x279d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.048152924 CET	8.8.8.8	192.168.2.3	0x279d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.048152924 CET	8.8.8.8	192.168.2.3	0x279d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.048152924 CET	8.8.8.8	192.168.2.3	0x279d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.048152924 CET	8.8.8.8	192.168.2.3	0x279d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.394547939 CET	8.8.8.8	192.168.2.3	0x5431	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:48.394547939 CET	8.8.8.8	192.168.2.3	0x5431	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:48.394547939 CET	8.8.8.8	192.168.2.3	0x5431	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.394547939 CET	8.8.8.8	192.168.2.3	0x5431	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.394547939 CET	8.8.8.8	192.168.2.3	0x5431	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.394547939 CET	8.8.8.8	192.168.2.3	0x5431	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.394547939 CET	8.8.8.8	192.168.2.3	0x5431	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.394547939 CET	8.8.8.8	192.168.2.3	0x5431	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.394547939 CET	8.8.8.8	192.168.2.3	0x5431	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.394547939 CET	8.8.8.8	192.168.2.3	0x5431	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.779051065 CET	8.8.8.8	192.168.2.3	0xb153	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:48.779051065 CET	8.8.8.8	192.168.2.3	0xb153	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:48.779051065 CET	8.8.8.8	192.168.2.3	0xb153	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.779051065 CET	8.8.8.8	192.168.2.3	0xb153	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.779051065 CET	8.8.8.8	192.168.2.3	0xb153	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.779051065 CET	8.8.8.8	192.168.2.3	0xb153	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.779051065 CET	8.8.8.8	192.168.2.3	0xb153	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.779051065 CET	8.8.8.8	192.168.2.3	0xb153	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.779051065 CET	8.8.8.8	192.168.2.3	0xb153	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:48.779051065 CET	8.8.8.8	192.168.2.3	0xb153	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:49.113298893 CET	8.8.8.8	192.168.2.3	0xefc2	No error (0)	i-43.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:49.113298893 CET	8.8.8.8	192.168.2.3	0xefc2	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:51:49.113298893 CET	8.8.8.8	192.168.2.3	0xefc2	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:49.113298893 CET	8.8.8.8	192.168.2.3	0xefc2	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:49.113298893 CET	8.8.8.8	192.168.2.3	0xefc2	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:49.113298893 CET	8.8.8.8	192.168.2.3	0xefc2	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:49.113298893 CET	8.8.8.8	192.168.2.3	0xefc2	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:49.113298893 CET	8.8.8.8	192.168.2.3	0xefc2	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:49.113298893 CET	8.8.8.8	192.168.2.3	0xefc2	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:51:49.113298893 CET	8.8.8.8	192.168.2.3	0xefc2	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:10.551425934 CET	8.8.8.8	192.168.2.3	0xdd9a	No error (0)	i-5600.b-1327.helper.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:52:10.551425934 CET	8.8.8.8	192.168.2.3	0xdd9a	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:52:10.551425934 CET	8.8.8.8	192.168.2.3	0xdd9a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:10.551425934 CET	8.8.8.8	192.168.2.3	0xdd9a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:10.551425934 CET	8.8.8.8	192.168.2.3	0xdd9a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:10.551425934 CET	8.8.8.8	192.168.2.3	0xdd9a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:10.551425934 CET	8.8.8.8	192.168.2.3	0xdd9a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:10.551425934 CET	8.8.8.8	192.168.2.3	0xdd9a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:10.551425934 CET	8.8.8.8	192.168.2.3	0xdd9a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:10.551425934 CET	8.8.8.8	192.168.2.3	0xdd9a	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:19.806502104 CET	8.8.8.8	192.168.2.3	0x43a7	No error (0)	i-34.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:52:19.806502104 CET	8.8.8.8	192.168.2.3	0x43a7	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:52:19.806502104 CET	8.8.8.8	192.168.2.3	0x43a7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:19.806502104 CET	8.8.8.8	192.168.2.3	0x43a7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:19.806502104 CET	8.8.8.8	192.168.2.3	0x43a7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:19.806502104 CET	8.8.8.8	192.168.2.3	0x43a7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:19.806502104 CET	8.8.8.8	192.168.2.3	0x43a7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:19.806502104 CET	8.8.8.8	192.168.2.3	0x43a7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:19.806502104 CET	8.8.8.8	192.168.2.3	0x43a7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:19.806502104 CET	8.8.8.8	192.168.2.3	0x43a7	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.179730892 CET	8.8.8.8	192.168.2.3	0x772d	No error (0)	i-21.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:52:20.179730892 CET	8.8.8.8	192.168.2.3	0x772d	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:52:20.179730892 CET	8.8.8.8	192.168.2.3	0x772d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.179730892 CET	8.8.8.8	192.168.2.3	0x772d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.179730892 CET	8.8.8.8	192.168.2.3	0x772d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.179730892 CET	8.8.8.8	192.168.2.3	0x772d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.179730892 CET	8.8.8.8	192.168.2.3	0x772d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.179730892 CET	8.8.8.8	192.168.2.3	0x772d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.179730892 CET	8.8.8.8	192.168.2.3	0x772d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.179730892 CET	8.8.8.8	192.168.2.3	0x772d	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.562185049 CET	8.8.8.8	192.168.2.3	0xadd0	No error (0)	i-34.b-45852.ut.bench.utorrent.com	bench.utp.st		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:52:20.562185049 CET	8.8.8.8	192.168.2.3	0xadd0	No error (0)	bench.utp.st	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 30, 2021 12:52:20.562185049 CET	8.8.8.8	192.168.2.3	0xadd0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.220.153	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.562185049 CET	8.8.8.8	192.168.2.3	0xadd0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		50.17.181.247	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.562185049 CET	8.8.8.8	192.168.2.3	0xadd0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.43.186	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.562185049 CET	8.8.8.8	192.168.2.3	0xadd0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		23.21.74.8	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.562185049 CET	8.8.8.8	192.168.2.3	0xadd0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.225.194.96	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.562185049 CET	8.8.8.8	192.168.2.3	0xadd0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		54.235.208.27	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.562185049 CET	8.8.8.8	192.168.2.3	0xadd0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		174.129.255.167	A (IP address)	IN (0x0001)
Jan 30, 2021 12:52:20.562185049 CET	8.8.8.8	192.168.2.3	0xadd0	No error (0)	com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com		107.22.246.37	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

i-21.b-45852.ut.bench.utorrent.com

i-30.b-45852.ut.bench.utorrent.com

apps.bittorrent.com

i-67.b-45852.ut.bench.utorrent.com

i-29.b-45852.ut.bench.utorrent.com

i-32.b-45852.ut.bench.utorrent.com

i-49.b-45852.ut.bench.utorrent.com

i-20.b-45852.ut.bench.utorrent.com

i-38.b-45852.ut.bench.utorrent.com

cdn.ap.bittorrent.com

cdn.bitmedianetwork.com

i-64.b-45852.ut.bench.utorrent.com

i-62.b-45852.ut.bench.utorrent.com

i-43.b-45852.ut.bench.utorrent.com

utorrent.com

www.utorrent.com

video.trontv.com

update.utorrent.com

btinstall-artifacts.bittorrent.com

utclient.utorrent.com

i-61.b-45852.ut.bench.utorrent.com

i-5600.b-1327.helper.bench.utorrent.com

i-34.b-45852.ut.bench.utorrent.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49730	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:25.559134007 CET	629	OUT	POST /e?i=21 HTTP/1.1 Host: i-21.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 276 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 35 31 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 73 69 6c 65 6e 74 5f 61 75 74 6f 75 70 64 61 74 65 22 2c 22 6c 61 75 6e 63 68 65 64 5f 74 61 72 67 65 74 22 3a 30 2c 22 75 70 64 61 74 65 64 22 3a 30 2c 22 72 65 6c 6f 63 61 74 65 64 22 3a 30 2c 22 76 65 72 73 69 6f 6e 73 22 3a 20 5b 5d 2c 20 22 61 63 74 69 6f 6e 22 3a 22 52 75 6e 6e 69 6e 67 45 6c 65 76 61 74 65 64 22 2c 20 22 67 5f 76 65 72 73 69 6f 6e 22 3a 31 31 31 39 31 35 38 30 34 2c 20 22 6e 6f 5f 73 61 75 22 3a 31 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039851,"eventName":"silent_autoupdate","launched_target":0,"updated":0,"relocated":0,"versions": [], "action":"RunningElevated", "g_version":111915804, "no_sau":1}
Jan 30, 2021 12:50:25.686065912 CET	629	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:25 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49731	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:25.952481031 CET	630	OUT	POST /e?i=30 HTTP/1.1 Host: i-30.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 176 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 35 34 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 53 68 75 74 64 6f 77 6e 44 75 72 61 74 69 6f 6e 22 2c 22 6c 61 73 74 5f 73 68 75 74 64 6f 77 6e 5f 64 75 72 61 74 69 6f 6e 22 3a 31 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":0,"pv":"","w":"10.0","cts":1612039854,"eventName":"ShutdownDuration","last_shutdown_duration":1}
Jan 30, 2021 12:50:26.083666086 CET	631	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:25 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49741	54.243.113.215	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:56.148607016 CET	677	OUT	POST /e?i=38 HTTP/1.1 Host: i-38.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 225 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 39 34 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 50 61 67 65 52 65 71 75 65 73 74 65 64 22 2c 22 64 61 74 65 22 3a 22 32 30 32 31 2d 30 31 2d 33 30 22 2c 22 74 69 6d 65 22 3a 22 31 32 3a 35 31 3a 33 34 22 2c 22 67 65 6f 22 3a 22 75 73 22 2c 22 73 69 74 65 69 64 22 3a 22 33 33 30 34 39 22 2c 22 61 64 74 79 70 65 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039894,"eventName":"PageRequested","date":"2021-01-30","time":"12:51:34","geo":"us","siteid":"33049","adtype":0}
Jan 30, 2021 12:50:56.279367924 CET	678	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:56 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.3	49895	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:50.401803017 CET	11082	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:50.455245972 CET	11084	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 4952e23e5b251bef23f5c85262b527d1 Age: 38075 Date: Sat, 30 Jan 2021 11:51:50 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:50.455298901 CET	11085	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:50.455348015 CET	11087	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:50.455399990 CET	11088	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:50.455451012 CET	11089	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:50.455498934 CET	11091	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:50.455542088 CET	11091	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.3	49896	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:50.679904938 CET	11092	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:50.738018036 CET	11093	IN	HTTP/1.1 200 OK x-amz-id-2: DF6VZPmQv8NRzciJ7qXC4WWaASDwVCa3ctfP2bVGjCeNDgUqKBo/N8+ce/8cQ6I36TvjTuoiOc4= x-amz-request-id: F02B6D84C94B9989 Content-Type: application/json Server: AmazonS3 X-LLID: 4c637871bca68f794a98c0e0a92aaf07 Age: 38075 Date: Sat, 30 Jan 2021 11:51:50 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:50.738075972 CET	11095	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:50.738136053 CET	11096	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:50.738194942 CET	11098	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:50.738250971 CET	11099	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:50.738308907 CET	11100	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:50.738363028 CET	11101	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.3	49897	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:51.158806086 CET	11102	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:51.214219093 CET	11103	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 0ecf0141f94e4b1d398d543701693d87 Age: 38076 Date: Sat, 30 Jan 2021 11:51:51 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:51.214287996 CET	11105	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:51.214349031 CET	11106	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:51.214440107 CET	11107	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:51.214519024 CET	11109	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:51.214570999 CET	11110	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:51.214622021 CET	11111	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.3	49898	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:51.608575106 CET	11111	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:51.663364887 CET	11113	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 492dbb896958db857fe9ed2c486b9f30 Age: 38076 Date: Sat, 30 Jan 2021 11:51:51 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:51.663428068 CET	11114	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:51.663489103 CET	11116	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:51.663548946 CET	11117	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:51.663609982 CET	11118	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:51.663671970 CET	11120	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:51.663726091 CET	11120	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.3	49899	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:52.085767984 CET	11121	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:52.144383907 CET	11122	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 10680b63ba2ddb24b7816169be797de1 Age: 38077 Date: Sat, 30 Jan 2021 11:51:52 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:52.144438982 CET	11124	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:52.144488096 CET	11125	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:52.144539118 CET	11127	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:52.144587994 CET	11128	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:52.144635916 CET	11129	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:52.144678116 CET	11130	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.3	49900	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:52.620501995 CET	11131	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:52.674981117 CET	11132	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: adac4423d65e7d341c0387402b837c7b Age: 38077 Date: Sat, 30 Jan 2021 11:51:52 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:52.675034046 CET	11133	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:52.675084114 CET	11135	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:52.675132036 CET	11136	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:52.675180912 CET	11138	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:52.675229073 CET	11139	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:52.675271988 CET	11140	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.3	49901	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:53.172039032 CET	11140	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:53.228542089 CET	11142	IN	HTTP/1.1 200 OK x-amz-id-2: E9EOQbeGIQ7BBLGvXhyxL1v2L3BUISNAdf/0cylPZjVIqMWt702lDO43mvo7OFXRJLMBENU6yBU= x-amz-request-id: 043AA3F0ECC70C0B Content-Type: application/json Server: AmazonS3 X-LLID: 762f2fdf3b70e7252f4c69e1685e4499 Age: 38078 Date: Sat, 30 Jan 2021 11:51:53 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:53.228606939 CET	11143	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:53.228667974 CET	11144	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:53.228729010 CET	11146	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:53.228791952 CET	11147	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:53.228851080 CET	11149	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:53.228904963 CET	11149	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.3	49902	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:53.787111998 CET	11150	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:53.843204021 CET	11151	IN	HTTP/1.1 200 OK x-amz-id-2: Os2VD+pHsVp3rMT4BRwvClCrfXhGwKBknz4H5Ewi9crIc252nmIGv6/lfLi6SmB5Tz46LWwg8a8= x-amz-request-id: CDCBCC14C601DB68 Content-Type: application/json Server: AmazonS3 X-LLID: 1f534dbb4712e163e64c2b97ce243f76 Age: 38078 Date: Sat, 30 Jan 2021 11:51:53 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:53.843259096 CET	11153	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:53.843308926 CET	11154	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:53.843358994 CET	11155	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:53.843409061 CET	11157	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:53.843460083 CET	11158	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:53.843503952 CET	11159	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.3	49903	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:54.243643999 CET	11160	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:54.298222065 CET	11161	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: ad6ab47e7cea79a1b12d85ae07f5c247 Age: 38079 Date: Sat, 30 Jan 2021 11:51:54 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:54.298280954 CET	11162	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:54.298332930 CET	11164	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:54.298383951 CET	11165	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:54.298434019 CET	11167	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:54.298485041 CET	11168	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:54.298526049 CET	11169	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.3	49904	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:54.652374029 CET	11169	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:54.706886053 CET	11171	IN	HTTP/1.1 200 OK x-amz-id-2: jwXezDPcH/gOHWUOETypqIFtLJZmMtwKexbupYZvn8E25c3JnCcgmJAlHtKTvO0GjZH0DxdDJu4= x-amz-request-id: 5FEE4E52F3232628 Content-Type: application/json Server: AmazonS3 X-LLID: a97c7092dbc0cb95f4dc8bee73c14f99 Age: 38079 Date: Sat, 30 Jan 2021 11:51:54 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:54.706943989 CET	11172	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:54.706993103 CET	11173	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:54.707073927 CET	11175	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:54.707158089 CET	11176	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:54.707211018 CET	11178	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:54.707257986 CET	11178	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49742	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:56.709532022 CET	679	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:50:56.765896082 CET	685	IN	HTTP/1.1 200 OK x-amz-id-2: jS5ggU0+KRwbQiW/769GhyBsMPKAZb3IsqJfpfXbsIQ8UgBvOKk1Na1DvxwWXyx6WeWPiQqAmpM= x-amz-request-id: CE86BEC04EF470C6 Content-Type: application/json Server: AmazonS3 X-LLID: 9e79ad2ead6008a105cc87f6d8148570 Age: 38021 Date: Sat, 30 Jan 2021 11:50:56 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:50:56.765969992 CET	686	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:50:56.766011000 CET	688	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:50:56.766047955 CET	689	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:50:56.766084909 CET	690	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:50:56.766124964 CET	692	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:50:56.766156912 CET	692	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.3	49905	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:55.518249035 CET	11179	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:55.573972940 CET	11180	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 0df544f74d9500aa4fab755a82f7cab2 Age: 38080 Date: Sat, 30 Jan 2021 11:51:55 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:55.574031115 CET	11182	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:55.574081898 CET	11183	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:55.574135065 CET	11184	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:55.574184895 CET	11186	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:55.574239969 CET	11187	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:55.574297905 CET	11188	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.3	49906	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:55.874392033 CET	11189	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:55.926760912 CET	11190	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 02d8e356c908553da9f811142dff3210 Age: 38080 Date: Sat, 30 Jan 2021 11:51:55 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:55.926810980 CET	11191	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:55.926858902 CET	11193	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:55.926908970 CET	11194	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:55.926955938 CET	11196	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:55.927004099 CET	11197	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:55.927045107 CET	11198	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.3	49907	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:56.128480911 CET	11198	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:56.180859089 CET	11200	IN	HTTP/1.1 200 OK x-amz-id-2: TqwzCiP6pFD8qhU1mWHOw4SixuhhW1/uymv5tbSpn3LHC9wBtO7w4zexYvmVneNQX5f0xPSK1wE= x-amz-request-id: AA9B24B5ADBC9AB6 Content-Type: application/json Server: AmazonS3 X-LLID: 32447a44ca5a166c3bb9f2f3a7b67120 Age: 38081 Date: Sat, 30 Jan 2021 11:51:56 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:56.180923939 CET	11201	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:56.180984020 CET	11202	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:56.181046963 CET	11204	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:56.181108952 CET	11205	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:56.181173086 CET	11207	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:56.181245089 CET	11207	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.3	49908	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:56.622550011 CET	11208	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:56.681404114 CET	11209	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 05c8029948a37eb9595f7739e05ef5b3 Age: 38081 Date: Sat, 30 Jan 2021 11:51:56 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:56.681477070 CET	11211	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:56.681536913 CET	11212	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:56.681597948 CET	11213	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:56.681657076 CET	11215	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:56.681715965 CET	11216	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:56.681768894 CET	11217	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.3	49909	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:56.874528885 CET	11218	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:56.929761887 CET	11219	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: e3265d074fef594a233d1ae873282c93 Age: 38081 Date: Sat, 30 Jan 2021 11:51:56 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:56.929850101 CET	11220	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:56.929914951 CET	11222	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:56.929976940 CET	11223	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:56.930037022 CET	11225	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:56.930097103 CET	11226	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:56.930151939 CET	11227	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.3	49910	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:57.216171980 CET	11227	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:57.272603989 CET	11229	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: db9b8259c6f6319bd380a08f548699ac Age: 38082 Date: Sat, 30 Jan 2021 11:51:57 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:57.272692919 CET	11230	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:57.272753954 CET	11231	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:57.272815943 CET	11233	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:57.272878885 CET	11234	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:57.272938967 CET	11236	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:57.273045063 CET	11236	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.3	49911	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:57.420211077 CET	11237	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:57.474208117 CET	11238	IN	HTTP/1.1 200 OK x-amz-id-2: tXWCBpoaGkiwJeDhne3UAJSYmSGZ4p9/z+XjPho1yLnozcCC0MN0pDfh2imCNhxurwHbC/2Tr2k= x-amz-request-id: A5B31C0B0A55B883 Content-Type: application/json Server: AmazonS3 X-LLID: 9a2b37b73b646d48154425d9a8ec4c9e Age: 38082 Date: Sat, 30 Jan 2021 11:51:57 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:57.474272966 CET	11240	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:57.474329948 CET	11241	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:57.474385977 CET	11243	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:57.474445105 CET	11244	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:57.474513054 CET	11245	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:57.474561930 CET	11246	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.3	49912	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:57.632174969 CET	11247	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:57.688493013 CET	11248	IN	HTTP/1.1 200 OK x-amz-id-2: wzFZ5CDJ8SUrbpb8o+Ly4cuzR//aKON3Z+Cx4Pc0J1dufk5HxZfn5r/0kGWzttF6mBI/EGeZXAQ= x-amz-request-id: 27348859562C468C Content-Type: application/json Server: AmazonS3 X-LLID: 824bc19f7e89cafaed5025aa939c9819 Age: 38082 Date: Sat, 30 Jan 2021 11:51:57 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:57.688549042 CET	11249	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:57.688597918 CET	11251	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:57.688647032 CET	11252	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:57.688694954 CET	11254	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:57.688743114 CET	11255	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:57.688786030 CET	11256	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.3	49913	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:59.372442961 CET	11256	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:59.427408934 CET	11258	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 5c95e4c450357e2ffe109f3b4b04518c Age: 38084 Date: Sat, 30 Jan 2021 11:51:59 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:59.427464962 CET	11259	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:59.427515984 CET	11261	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:59.427563906 CET	11262	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:59.427614927 CET	11263	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:59.427663088 CET	11265	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:59.427706003 CET	11265	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.3	49914	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:59.719146967 CET	11266	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:59.772548914 CET	11268	IN	HTTP/1.1 200 OK x-amz-id-2: Os2VD+pHsVp3rMT4BRwvClCrfXhGwKBknz4H5Ewi9crIc252nmIGv6/lfLi6SmB5Tz46LWwg8a8= x-amz-request-id: CDCBCC14C601DB68 Content-Type: application/json Server: AmazonS3 X-LLID: d08eadcbaac7542009ece0d9bfd24e2e Age: 38084 Date: Sat, 30 Jan 2021 11:51:59 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:59.772600889 CET	11269	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:59.772650957 CET	11270	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:59.772700071 CET	11272	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:59.772749901 CET	11273	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:59.772819996 CET	11275	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:59.772845030 CET	11275	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49743	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:56.709616899 CET	679	OUT	GET /control/feature/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Connection: Close
Jan 30, 2021 12:50:56.761878014 CET	680	IN	HTTP/1.1 200 OK x-amz-id-2: I/FP3hjXdYz/xa6Kh/zMauFPUEDmAAwQWRMfXRO3VfYQythPvXw0aibNxcPeqWpi+aaFwe0Avag= x-amz-request-id: AT5PFVAQ7ZFWER8R Content-Type: application/json Server: AmazonS3 X-LLID: cd518cd0b5e0e9026f787de46630f429 Age: 38021 Date: Sat, 30 Jan 2021 11:50:56 GMT Last-Modified: Tue, 26 Jan 2021 00:03:55 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 3477 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0a 20 20 20 20 22 63 6f 6d 6d 6f 6e 72 75 6c 65 73 22 3a 20 5b 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 49 6e 74 65 72 76 61 6c 22 3a 20 36 30 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 72 75 6c 65 48 61 73 68 22 3a 20 22 22 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 5d 2c 0a 20 20 20 20 22 63 6f 72 65 72 75 6c 65 73 22 3a 20 5b 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 5f 66 22 3a 20 22 31 30 30 2e 30 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 73 74 72 65 61 6d 69 6e 67 54 72 69 61 6c 45 6e 61 62 6c 65 64 22 3a 20 30 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 73 74 72 65 61 6d 69 6e 67 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 62 61 64 41 64 73 52 65 70 6f 72 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6f 6e 62 6f 61 72 64 69 6e 67 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6f 6e 62 6f 61 72 64 69 6e 67 46 69 72 73 74 55 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 74 63 6c 69 65 6e 74 2e 75 74 6f 72 72 65 6e 74 2e 63 6f 6d 2f 63 6c 69 65 6e 74 2d 75 73 65 72 2d 6f 6e 62 6f 61 72 64 69 6e 67 2f 69 6e 64 65 78 2e 68 74 6d 6c 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6f 6e 62 6f 61 72 64 69 6e 67 53 65 63 6f 6e 64 55 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 74 63 6c 69 65 6e 74 2e 75 74 6f 72 72 65 6e 74 2e 63 6f 6d 2f 63 6c 69 65 6e 74 2d 75 73 65 72 2d 6f 6e 62 6f 61 72 64 69 6e 67 2f 73 65 63 6f 6e 64 2d 65 6e 74 72 79 2d 69 6e 64 65 78 2e 68 74 6d 6c 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 61 64 53 6f 75 72 63 65 22 20 3a 20 30 0a 20 20 20 20 20 20 20 20 7d 2c 0a 09 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 6e 65 77 41 64 53 65 72 76 65 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 5f 66 22 3a 20 22 31 30 2e 30 22 2c 0a 09 20 20 20 20 22 73 74 72 65 61 6d 69 6e 67 54 72 69 61 6c 45 6e 61 62 6c 65 64 22 3a 20 30 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 73 74 72 65 61 6d 69 6e 67 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 62 61 64 41 64 73 52 65 70 6f 72 74 45 6e 61 62 6c 65 64 22 3a Data Ascii: { "commonrules": [ { "version": 0, "contactInterval": 60, "ruleHash": "" } ], "corerules": [ { "name": "default", "rollout": 100, "rollout_f": "100.0", "streamingTrialEnabled": 0, "streamingEnabled": 1, "badAdsReportEnabled": 1, "onboardingEnabled": 1, "onboardingFirstUrl": "https://utclient.utorrent.com/client-user-onboarding/index.html", "onboardingSecondUrl": "https://utclient.utorrent.com/client-user-onboarding/second-entry-index.html", "adSource" : 0 },{ "name": "newAdServer", "rollout": 10, "rollout_f": "10.0", "streamingTrialEnabled": 0, "streamingEnabled": 1, "badAdsReportEnabled":
Jan 30, 2021 12:50:56.761919975 CET	682	IN	Data Raw: 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6f 6e 62 6f 61 72 64 69 6e 67 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6f 6e 62 6f 61 72 64 69 6e 67 46 69 72 73 74 55 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f Data Ascii: 1, "onboardingEnabled": 1, "onboardingFirstUrl": "https://utclient.utorrent.com/client-user-onboarding/index.html", "onboardingSecondUrl": "https://utclient.utorrent.com/client-user-onboarding/second-entry-
Jan 30, 2021 12:50:56.761955976 CET	683	IN	Data Raw: 61 6d 70 61 69 67 6e 43 6f 64 65 73 22 3a 20 5b 36 30 31 5d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 62 75 6e 64 6c 65 73 54 61 62 45 6e 61 62 6c 65 64 22 3a 20 31 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 5d 2c 0a 20 20 20 20 22 63 6f 6f Data Ascii: ampaignCodes": [601], "bundlesTabEnabled": 1 } ], "cookiedrop": [ { "refreshTime": 7, "enable": 1, "cookie_drop_url": "http://utorrent.com/prodnews" } ], "

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.3	49915	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:59.973361969 CET	11276	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:00.030177116 CET	11277	IN	HTTP/1.1 200 OK x-amz-id-2: DF6VZPmQv8NRzciJ7qXC4WWaASDwVCa3ctfP2bVGjCeNDgUqKBo/N8+ce/8cQ6I36TvjTuoiOc4= x-amz-request-id: F02B6D84C94B9989 Content-Type: application/json Server: AmazonS3 X-LLID: c442bbb37a4b1168663cbeed66778662 Age: 38085 Date: Sat, 30 Jan 2021 11:52:00 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:00.030245066 CET	11279	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:00.030307055 CET	11280	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:00.030368090 CET	11282	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:00.030430079 CET	11283	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:00.030488968 CET	11284	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:00.030544996 CET	11285	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.3	49916	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:00.207834959 CET	11286	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:00.260621071 CET	11287	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: a69ca8f21401a2cc3e3d2695853acec1 Age: 38085 Date: Sat, 30 Jan 2021 11:52:00 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:00.260675907 CET	11288	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:00.260725021 CET	11290	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:00.260792017 CET	11291	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:00.260845900 CET	11293	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:00.260905027 CET	11294	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:00.260946989 CET	11295	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.3	49917	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:00.430445910 CET	11295	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:00.486484051 CET	11297	IN	HTTP/1.1 200 OK x-amz-id-2: UOvX8aGYkYFWkID53azq1/EYzRk1QGJfybzGLYWCgco108K4s+VQr2B+cgQVbKkib5tp2K4r21A= x-amz-request-id: 30E1DCBF030755F0 Content-Type: application/json Server: AmazonS3 X-LLID: 3eb3b72dd0ada40f4be06aba5bb51fcc Age: 38085 Date: Sat, 30 Jan 2021 11:52:00 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:00.486540079 CET	11298	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:00.486602068 CET	11299	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:00.486656904 CET	11301	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:00.486706972 CET	11302	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:00.486757040 CET	11304	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:00.486799955 CET	11304	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.3	49918	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:00.781806946 CET	11305	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:00.836256027 CET	11306	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: c41505b568f1784f36cecb8f4d7a8ad9 Age: 38085 Date: Sat, 30 Jan 2021 11:52:00 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:00.836311102 CET	11308	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:00.836366892 CET	11309	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:00.836426020 CET	11311	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:00.836493015 CET	11312	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:00.836551905 CET	11313	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:00.836604118 CET	11314	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.3	49919	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:01.086885929 CET	11315	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:01.144591093 CET	11316	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 789f47c1a3be38e2e87000bb3478d1f6 Age: 38086 Date: Sat, 30 Jan 2021 11:52:01 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:01.144655943 CET	11317	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:01.144716978 CET	11319	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:01.144778013 CET	11320	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:01.144838095 CET	11322	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:01.144898891 CET	11323	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:01.144953966 CET	11324	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.3	49920	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:01.411973000 CET	11324	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:01.464638948 CET	11326	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: b2b7008e806b3c2827d5417d5214dd7e Age: 38086 Date: Sat, 30 Jan 2021 11:52:01 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:01.464699984 CET	11327	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:01.464761972 CET	11328	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:01.464821100 CET	11330	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:01.464880943 CET	11331	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:01.464941978 CET	11333	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:01.464996099 CET	11333	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.3	49921	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:01.703351974 CET	11334	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:01.758558035 CET	11335	IN	HTTP/1.1 200 OK x-amz-id-2: tXWCBpoaGkiwJeDhne3UAJSYmSGZ4p9/z+XjPho1yLnozcCC0MN0pDfh2imCNhxurwHbC/2Tr2k= x-amz-request-id: A5B31C0B0A55B883 Content-Type: application/json Server: AmazonS3 X-LLID: 0100689b569fee36e98f6f3ff9c1c35d Age: 38086 Date: Sat, 30 Jan 2021 11:52:01 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:01.758611917 CET	11337	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:01.758661032 CET	11338	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:01.758712053 CET	11339	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:01.758761883 CET	11341	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:01.758810997 CET	11342	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:01.758853912 CET	11343	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.3	49922	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:01.945713043 CET	11344	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:02.001671076 CET	11345	IN	HTTP/1.1 200 OK x-amz-id-2: K9OCqfmui2KGYTcnt0PtwclY9HmCJSqumvf1Rdroj6RCbSvhrJWuACg0PXuVKdLAgYCu3kROcFo= x-amz-request-id: 8K3SBYAMEV9G9Y8Y Content-Type: application/json Server: AmazonS3 X-LLID: 9d4a2f5ab64bc005793eca5497e06486 Age: 38086 Date: Sat, 30 Jan 2021 11:52:01 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:02.001729012 CET	11346	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:02.001777887 CET	11348	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:02.001828909 CET	11349	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:02.001878023 CET	11350	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:02.001926899 CET	11352	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:02.001969099 CET	11353	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.3	49923	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:02.301947117 CET	11353	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:02.355660915 CET	11355	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 2378d93545263ba08812cad656388270 Age: 38087 Date: Sat, 30 Jan 2021 11:52:02 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:02.355716944 CET	11356	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:02.355770111 CET	11357	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:02.355820894 CET	11359	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:02.355870008 CET	11360	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:02.355923891 CET	11362	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:02.355968952 CET	11362	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.3	49924	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:02.543929100 CET	11363	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:02.598926067 CET	11364	IN	HTTP/1.1 200 OK x-amz-id-2: Os2VD+pHsVp3rMT4BRwvClCrfXhGwKBknz4H5Ewi9crIc252nmIGv6/lfLi6SmB5Tz46LWwg8a8= x-amz-request-id: CDCBCC14C601DB68 Content-Type: application/json Server: AmazonS3 X-LLID: 56e30979ceef7546731757f167354126 Age: 38087 Date: Sat, 30 Jan 2021 11:52:02 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:02.598979950 CET	11366	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:02.599029064 CET	11367	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:02.599078894 CET	11368	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:02.599128008 CET	11370	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:02.599178076 CET	11371	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:02.599220991 CET	11372	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49745	178.79.242.181	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:57.247925997 CET	694	OUT	GET /network/index.html?adt=4&browser=ie&clientdata=ut%7c3%2e5%2e5%2e45852%7c290&geo=us&id=&ie=11&site=33049&uid=gGnNQ4MmOM9LtEpU&usermuted=0&w=1122893834&langs=en HTTP/1.1 Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: cdn.bitmedianetwork.com Connection: Keep-Alive
Jan 30, 2021 12:50:57.305890083 CET	695	IN	HTTP/1.1 200 OK x-amz-id-2: iCsHhbB+F/KRTmFwWips/zrXBqzgfiD+cdJTycmcTFqhNndJg+R7zLdFDJM6wQYN7Zpn2PWLg0E= x-amz-request-id: DF69BA7AEDE9A5CE Content-Type: text/html Server: AmazonS3 X-LLID: 8dd36c92cf3019fb51c22521326511a1 Age: 38022 Date: Sat, 30 Jan 2021 11:50:57 GMT Last-Modified: Wed, 22 Jul 2020 23:27:00 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 595 Connection: keep-alive Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 73 73 2f 73 74 79 6c 65 73 2e 63 73 73 22 20 2f 3e 0a 20 20 20 20 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 61 73 73 65 74 73 2f 6a 73 2f 33 70 2f 69 65 38 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 20 69 64 3d 22 67 72 61 6e 64 66 61 74 68 65 72 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 6d 61 74 63 68 28 27 57 65 62 41 64 50 6c 61 79 65 72 27 29 29 20 7b 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 20 3d 20 27 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 62 6c 61 63 6b 3b 27 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 74 2d 61 70 2d 77 72 61 70 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 62 74 5f 61 70 5f 64 69 76 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2e 2e 2f 61 64 7a 65 72 6b 2f 61 64 6f 73 2d 62 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2e 2e 2f 61 73 73 65 74 73 2f 6a 73 2f 69 6e 64 65 78 2d 62 75 6e 64 6c 65 64 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html> <head> <link rel="stylesheet" type="text/css" href="assets/css/styles.css" /> ...[if IE 8]><script src="/assets/js/3p/ie8.js"></script><![endif]--> </head> <body id="grandfather"> <script type="text/javascript"> if (window.location.href.match('WebAdPlayer')) { document.body.style.cssText = 'background-color: black;'; } </script> <div class="bt-ap-wrap"> <div id="bt_ap_div"></div> </div> <script src="../adzerk/ados-bt.js"></script> <script src="../assets/js/index-bundled.js"></script> </body></html>
Jan 30, 2021 12:50:57.332173109 CET	696	OUT	GET /network/assets/css/styles.css HTTP/1.1 Accept: / Referer: http://cdn.bitmedianetwork.com/network/index.html?adt=4&browser=ie&clientdata=ut%7c3.5.5.45852%7c290&geo=us&id=&ie=11&site=33049&uid=gGnNQ4MmOM9LtEpU&usermuted=0&w=1122893834&langs=en Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: cdn.bitmedianetwork.com Connection: Keep-Alive
Jan 30, 2021 12:50:57.388974905 CET	697	IN	HTTP/1.1 200 OK x-amz-id-2: mf1exAMGKZVw26cQWZeWBM1Gs5ah7CxPumvby/Vorw0mQ1E59BZIC9iLmKArz0nik/Zq6bYPlvg= x-amz-request-id: 32A2CB0B8F2F62E3 Content-Type: text/css Server: AmazonS3 X-LLID: 46e87e9346a826b5e90981625fc9ad78 Age: 37866 Date: Sat, 30 Jan 2021 11:50:57 GMT Last-Modified: Sat, 30 Jan 2021 01:17:15 GMT Expires: Sun, 31 Jan 2021 01:19:51 GMT Content-Length: 687 Connection: keep-alive Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 67 72 61 6e 64 66 61 74 68 65 72 2c 20 23 62 74 5f 61 70 5f 64 69 76 20 7b 0a 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 74 6f 70 3a 20 30 70 78 3b 0a 20 20 6c 65 66 74 3a 20 30 70 78 3b 0a 7d 0a 0a 68 74 6d 6c 20 7b 0a 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 7d 0a 0a 62 6f 64 79 23 67 72 61 6e 64 66 61 74 68 65 72 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 34 46 34 46 34 3b 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 0a 20 20 77 69 64 74 68 3a 20 31 30 30 25 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 20 6a 75 73 74 69 66 79 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 20 63 65 6e 74 65 72 3b 0a 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 20 6a 75 73 74 69 66 79 3b 0a 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 0a 2e 62 74 2d 61 70 2d 77 72 61 70 20 7b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 7d 0a 0a 23 62 74 5f 61 70 5f 64 69 76 20 7b 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 7d Data Ascii: html, body, #grandfather, #bt_ap_div { padding: 0; margin: 0; top: 0px; left: 0px;}html { height: 100%;}body#grandfather { background-color: #F4F4F4; overflow: hidden; width: 100% !important; height: 100% !important; display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-box-pack: justify; -webkit-justify-content: center; -ms-flex-pack: center; -moz-box-pack: justify; justify-content: center; -webkit-box-align: center; -webkit-align-items: center; -moz-box-align: center; -ms-flex-align: center; align-items: center;}.bt-ap-wrap { position: relative;}#bt_ap_div { overflow: hidden;}
Jan 30, 2021 12:50:57.417093992 CET	698	OUT	GET /assets/js/index-bundled.js HTTP/1.1 Accept: / Referer: http://cdn.bitmedianetwork.com/network/index.html?adt=4&browser=ie&clientdata=ut%7c3.5.5.45852%7c290&geo=us&id=&ie=11&site=33049&uid=gGnNQ4MmOM9LtEpU&usermuted=0&w=1122893834&langs=en Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: cdn.bitmedianetwork.com Connection: Keep-Alive
Jan 30, 2021 12:50:57.473439932 CET	730	IN	HTTP/1.1 200 OK x-amz-id-2: oYICVPDZs/k8yZekM2mwW9bFvOPntYw37rwKDsorrAKKoAnYJsX4pCKttFMej0dRM0AfXmF0HcA= x-amz-request-id: D61FAF201E40829F Content-Type: application/javascript Server: AmazonS3 X-LLID: d6c56c3a0effa6234926d1e7e2fd3cb7 Age: 38021 Date: Sat, 30 Jan 2021 11:50:57 GMT Last-Modified: Thu, 03 Oct 2019 21:15:29 GMT Expires: Sun, 31 Jan 2021 01:17:16 GMT Content-Length: 112483 Connection: keep-alive Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 21 66 75 6e 63 74 69 6f 6e 20 69 28 6f 2c 61 2c 73 29 7b 66 75 6e 63 74 69 6f 6e 20 6c 28 6e 2c 65 29 7b 69 66 28 21 61 5b 6e 5d 29 7b 69 66 28 21 6f 5b 6e 5d 29 7b 76 61 72 20 74 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 26 26 72 65 71 75 69 72 65 3b 69 66 28 21 65 26 26 74 29 72 65 74 75 72 6e 20 74 28 6e 2c 21 30 29 3b 69 66 28 75 29 72 65 74 75 72 6e 20 75 28 6e 2c 21 30 29 3b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 6d 6f 64 75 6c 65 20 27 22 2b 6e 2b 22 27 22 29 7d 76 61 72 20 72 3d 61 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6f 5b 6e 5d 5b 30 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 6f 5b 6e 5d 5b 31 5d 5b 65 5d 3b 72 65 74 75 72 6e 20 6c 28 74 7c 7c 65 29 7d 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 69 2c 6f 2c 61 2c 73 29 7d 72 65 74 75 72 6e 20 61 5b 6e 5d 2e 65 78 70 6f 72 74 73 7d 66 6f 72 28 76 61 72 20 75 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 26 26 72 65 71 75 69 72 65 2c 65 3d 30 3b 65 3c 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 6c 28 73 5b 65 5d 29 3b 72 65 74 75 72 6e 20 6c 7d 28 7b 31 3a 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 63 3d 7b 5f 6b 65 79 53 74 72 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 3d 22 2c 65 6e 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 2c 72 2c 69 2c 6f 2c 61 2c 73 2c 6c 3d 22 22 2c 75 3d 30 3b 66 6f 72 28 65 3d 63 2e 5f 75 74 66 38 5f 65 6e 63 6f 64 65 28 65 29 3b 75 3c 65 2e 6c 65 6e 67 74 68 3b 29 69 3d 28 74 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 75 2b 2b 29 29 3e 3e 32 2c 6f 3d 28 33 26 74 29 3c 3c 34 7c 28 6e 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 75 2b 2b 29 29 3e 3e 34 2c 61 3d 28 31 35 26 6e 29 3c 3c 32 7c 28 72 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 75 2b 2b 29 29 3e 3e 36 2c 73 3d 36 33 26 72 2c 69 73 4e 61 4e 28 6e 29 3f 61 3d 73 3d 36 34 3a 69 73 4e 61 4e 28 72 29 26 26 28 73 3d 36 34 29 2c 6c 3d 6c 2b 74 68 69 73 2e 5f 6b 65 79 53 74 72 2e 63 68 61 72 41 74 28 69 29 2b 74 68 69 73 2e 5f 6b 65 79 53 74 72 2e 63 68 61 72 41 74 28 6f 29 2b 74 68 69 73 2e 5f 6b 65 79 53 74 72 2e 63 68 61 72 41 74 28 61 29 2b 74 68 69 73 2e 5f 6b 65 79 53 74 72 2e 63 68 61 72 41 74 28 73 29 3b 72 65 74 75 72 6e 20 6c 7d 2c 64 65 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 Data Ascii: !function i(o,a,s){function l(n,e){if(!a[n]){if(!o[n]){var t="function"==typeof require&&require;if(!e&&t)return t(n,!0);if(u)return u(n,!0);throw new Error("Cannot find module '"+n+"'")}var r=a[n]={exports:{}};o[n][0].call(r.exports,function(e){var t=o[n][1][e];return l(t\|\|e)},r,r.exports,i,o,a,s)}return a[n].exports}for(var u="function"==typeof require&&require,e=0;e<s.length;e++)l(s[e]);return l}({1:[function(e,t,n){var c={_keyStr:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",encode:function(e){var t,n,r,i,o,a,s,l="",u=0;for(e=c._utf8_encode(e);u<e.length;)i=(t=e.charCodeAt(u++))>>2,o=(3&t)<<4\|(n=e.charCodeAt(u++))>>4,a=(15&n)<<2\|(r=e.charCodeAt(u++))>>6,s=63&r,isNaN(n)?a=s=64:isNaN(r)&&(s=64),l=l+this._keyStr.charAt(i)+this._keyStr.charAt(o)+this._keyStr.charAt(a)+this._keyStr.charAt(s);return l},decode:function(
Jan 30, 2021 12:50:57.473483086 CET	731	IN	Data Raw: 65 29 7b 76 61 72 20 74 2c 6e 2c 72 2c 69 2c 6f 2c 61 2c 73 3d 22 22 2c 6c 3d 30 3b 66 6f 72 28 65 3d 65 2e 72 65 70 6c 61 63 65 28 2f 5b 5e 41 2d 5a 61 2d 7a 30 2d 39 5c 2b 5c 2f 5c 3d 5d 2f 67 2c 22 22 29 3b 6c 3c 65 2e 6c 65 6e 67 74 68 3b 29 Data Ascii: e){var t,n,r,i,o,a,s="",l=0;for(e=e.replace(/[^A-Za-z0-9\+\/\=]/g,"");l<e.length;)t=this._keyStr.indexOf(e.charAt(l++))<<2\|(i=this._keyStr.indexOf(e.charAt(l++)))>>4,n=(15&i)<<4\|(o=this._keyStr.indexOf(e.charAt(l++)))>>2,r=(3&o)<<6\|(a=this._ke
Jan 30, 2021 12:50:57.473535061 CET	732	IN	Data Raw: 61 74 65 50 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 61 72 20 69 3d 22 68 74 74 70 73 3a 2f 2f 69 2d 22 2b 6e 2b 22 2e 62 2d 30 2e 61 64 2e 62 65 6e 63 68 2e 75 74 6f 72 72 65 6e 74 2e 63 6f 6d 2f 22 2c 6f 3d 7b 65 76 Data Ascii: atePing:function(e,t,n,r){var i="https://i-"+n+".b-0.ad.bench.utorrent.com/",o={eventName:e+(t?"."+t:"")};for(var a in r)o[a]=r[a];var s=document.location.href;document.referrer&&(this.getHostName(document.referrer)!==this.getHostName(s)\|\|s.ma
Jan 30, 2021 12:50:57.473575115 CET	734	IN	Data Raw: 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 2e 73 65 72 76 65 41 64 73 28 29 7d 2c 33 65 35 29 29 3a 69 2e 73 65 72 76 65 41 64 73 28 29 2c 77 69 6e 64 6f 77 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 65 Data Ascii: ow.setTimeout(function(){i.serveAds()},3e5)):i.serveAds(),window.hasOwnProperty("external")&&window.external.hasOwnProperty("mute")&&(window.external.mute(),r("body").hover(function(){window.external.unmute()},function(){window.external.mute()
Jan 30, 2021 12:50:57.473611116 CET	735	IN	Data Raw: 7d 2c 6c 61 73 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 71 28 2d 31 29 7d 2c 65 71 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6c 65 6e 67 74 68 2c 6e 3d 2b 65 2b 28 65 3c 30 3f 74 Data Ascii: },last:function(){return this.eq(-1)},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor(null)},push:s,sort:d.sort,splice:d.splice},T.extend=T.
Jan 30, 2021 12:50:57.473658085 CET	737	IN	Data Raw: 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 20 6d 2e 63 61 6c 6c 28 65 2c 74 29 3b 66 6f 72 28 74 20 69 6e 20 65 29 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 6d 2e 63 61 6c 6c 28 65 2c 74 29 7d 2c 74 79 70 65 3a 66 75 6e 63 74 69 Data Ascii: (t in e)return m.call(e,t);for(t in e);return void 0===t\|\|m.call(e,t)},type:function(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[t.call(e)]\|\|"object":typeof e},globalEval:function(e){e&&T.trim(e)&&(h.execScript\|\|function(
Jan 30, 2021 12:50:57.473700047 CET	738	IN	Data Raw: 6f 72 28 69 20 69 6e 20 65 29 6e 75 6c 6c 21 3d 28 72 3d 74 28 65 5b 69 5d 2c 69 2c 6e 29 29 26 26 61 2e 70 75 73 68 28 72 29 3b 72 65 74 75 72 6e 20 67 2e 61 70 70 6c 79 28 5b 5d 2c 61 29 7d 2c 67 75 69 64 3a 31 2c 70 72 6f 78 79 3a 66 75 6e 63 Data Ascii: or(i in e)null!=(r=t(e[i],i,n))&&a.push(r);return g.apply([],a)},guid:1,proxy:function(e,t){var n,r,i;if("string"==typeof t&&(i=e[t],t=e,e=i),T.isFunction(e))return n=c.call(arguments,2),(r=function(){return e.apply(t\|\|this,n.concat(c.call(arg
Jan 30, 2021 12:50:57.473783970 CET	740	IN	Data Raw: 45 78 70 28 22 5e 22 2b 49 2b 22 2a 28 5b 3e 2b 7e 5d 7c 22 2b 49 2b 22 29 22 2b 49 2b 22 2a 22 29 2c 58 3d 6e 65 77 20 52 65 67 45 78 70 28 22 3d 22 2b 49 2b 22 2a 28 5b 5e 5c 5c 5d 27 5c 22 5d 2a 3f 29 22 2b 49 2b 22 2a 5c 5c 5d 22 2c 22 67 22 Data Ascii: Exp("^"+I+"([>+~]\|"+I+")"+I+""),X=new RegExp("="+I+"([^\\]'\"]?)"+I+"\\]","g"),V=new RegExp(B),U=new RegExp("^"+M+"$"),J={ID:new RegExp("^#("+F+")"),CLASS:new RegExp("^\\.("+F+")"),TAG:new RegExp("^("+F.replace("w","w")+")"),ATTR:new Reg
Jan 30, 2021 12:50:57.473840952 CET	741	IN	Data Raw: 3d 73 26 26 28 69 3d 4b 2e 65 78 65 63 28 65 29 29 29 69 66 28 61 3d 69 5b 31 5d 29 7b 69 66 28 39 3d 3d 3d 73 29 7b 69 66 28 21 28 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 29 29 7c 7c 21 6f 2e 70 61 72 65 6e 74 4e 6f 64 65 29 Data Ascii: =s&&(i=K.exec(e)))if(a=i[1]){if(9===s){if(!(o=t.getElementById(a))\|\|!o.parentNode)return n;if(o.id===a)return n.push(o),n}else if(t.ownerDocument&&(o=t.ownerDocument.getElementById(a))&&T(t,o)&&o.id===a)return n.push(o),n}else{if(i[2])return H
Jan 30, 2021 12:50:57.474011898 CET	742	IN	Data Raw: 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 69 6e 70 75 74 22 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 26 26 65 2e 74 79 70 65 3d 3d 3d 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 64 65 28 Data Ascii: urn function(e){return"input"===e.nodeName.toLowerCase()&&e.type===t}}function de(n){return function(e){var t=e.nodeName.toLowerCase();return("input"===t\|\|"button"===t)&&e.type===n}}function fe(a){return ae(function(o){return o=+o,ae(function(
Jan 30, 2021 12:50:57.474061966 CET	744	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 3d 3d 3d 74 7d 7d 29 3a 28 64 65 6c 65 74 65 20 78 2e 66 69 6e 64 2e 49 44 2c 78 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: tion(e){return e.getAttribute("id")===t}}):(delete x.find.ID,x.filter.ID=function(e){var n=e.replace(te,ne);return function(e){var t=void 0!==e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}}),x.find.TAG=h.getElementsByTagNa

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.3	49925	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:02.769221067 CET	11373	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:02.825329065 CET	11374	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 71b4b23c5d5eb70b1194e0cbf6b3a34a Age: 38087 Date: Sat, 30 Jan 2021 11:52:02 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:02.825381994 CET	11375	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:02.825462103 CET	11377	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:02.825535059 CET	11378	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:02.825584888 CET	11379	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:02.825656891 CET	11381	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:02.825719118 CET	11381	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.3	49926	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:03.027918100 CET	11382	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:03.082770109 CET	11384	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 31356776ab91a228d892a5e66f73d8cd Age: 38088 Date: Sat, 30 Jan 2021 11:52:03 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:03.082834959 CET	11385	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:03.082896948 CET	11386	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:03.082961082 CET	11388	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:03.083022118 CET	11389	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:03.083082914 CET	11391	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:03.083138943 CET	11391	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.3	49927	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:03.341181040 CET	11392	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:03.395637035 CET	11393	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 45953a8d487a056505ee532d76c51670 Age: 38088 Date: Sat, 30 Jan 2021 11:52:03 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:03.395689011 CET	11395	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:03.395740032 CET	11396	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:03.395787954 CET	11397	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:03.395839930 CET	11399	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:03.395888090 CET	11400	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:03.395930052 CET	11401	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.3	49928	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:03.582851887 CET	11401	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:03.638638020 CET	11403	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: b1c570182b36b4eace0e36236da9ebfb Age: 38088 Date: Sat, 30 Jan 2021 11:52:03 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:03.638710976 CET	11404	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:03.638766050 CET	11406	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:03.638817072 CET	11407	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:03.638865948 CET	11408	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:03.638916016 CET	11410	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:03.638958931 CET	11410	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.3	49929	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:03.818026066 CET	11411	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:03.870570898 CET	11413	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 0c7062b29b3778a6b781836d38866fb7 Age: 38088 Date: Sat, 30 Jan 2021 11:52:03 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:03.870625973 CET	11414	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:03.870676994 CET	11415	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:03.870726109 CET	11417	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:03.870814085 CET	11418	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:03.870865107 CET	11420	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:03.870908022 CET	11420	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.3	49930	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:04.013942003 CET	11421	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:04.067305088 CET	11423	IN	HTTP/1.1 200 OK x-amz-id-2: 9WJeYnXrxagGOXERojUJ6ymAxnFP6psl08FMVlyo+q+rbd9GgrWoxvlBX65qvFzwaFdpH9svb+E= x-amz-request-id: F86F2AE72B33AA07 Content-Type: application/json Server: AmazonS3 X-LLID: 09dee779889cb4db56cae3757ffbd3e8 Age: 38089 Date: Sat, 30 Jan 2021 11:52:04 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:04.067364931 CET	11424	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:04.067415953 CET	11425	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:04.067465067 CET	11427	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:04.067514896 CET	11428	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:04.067563057 CET	11429	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:04.067605972 CET	11430	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.3	49931	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:04.281050920 CET	11431	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:04.336544037 CET	11432	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 2f816f16948fefac27324a1db554d43f Age: 38089 Date: Sat, 30 Jan 2021 11:52:04 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:04.336601019 CET	11434	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:04.336651087 CET	11435	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:04.336699009 CET	11436	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:04.336749077 CET	11438	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:04.336797953 CET	11439	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:04.336842060 CET	11440	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.3	49932	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:04.532146931 CET	11441	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:04.587172985 CET	11442	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: c1c1569fcb1e9127cac92574dd259f9b Age: 38089 Date: Sat, 30 Jan 2021 11:52:04 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:04.587280035 CET	11443	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:04.587332010 CET	11445	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:04.587380886 CET	11446	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:04.587430000 CET	11447	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:04.587482929 CET	11449	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:04.587526083 CET	11449	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.3	49933	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:04.789177895 CET	11450	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:04.842871904 CET	11452	IN	HTTP/1.1 200 OK x-amz-id-2: qL5CX/4ohWNbaxC22Q3VR4ZCEsdoN/2MXAJPd/kh6x8cZQe+QYQkppjk9YRZsIcOZgu3/XVkQjo= x-amz-request-id: B08BBFACA0427967 Content-Type: application/json Server: AmazonS3 X-LLID: bf424cdce9da43fdef6e251a9a0c942b Age: 38089 Date: Sat, 30 Jan 2021 11:52:04 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:04.842927933 CET	11453	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:04.842978954 CET	11455	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:04.843033075 CET	11456	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:04.843081951 CET	11457	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:04.843131065 CET	11459	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:04.843173981 CET	11459	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.3	49934	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:05.020829916 CET	11460	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:05.077281952 CET	11462	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 805b160f65bc51fa3cc12204120f8455 Age: 38090 Date: Sat, 30 Jan 2021 11:52:05 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:05.077347994 CET	11463	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:05.077431917 CET	11464	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:05.077493906 CET	11466	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:05.077553034 CET	11467	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:05.077613115 CET	11468	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:05.077667952 CET	11469	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49746	178.79.242.181	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:57.415364027 CET	698	OUT	GET /adzerk/ados-bt.js HTTP/1.1 Accept: / Referer: http://cdn.bitmedianetwork.com/network/index.html?adt=4&browser=ie&clientdata=ut%7c3.5.5.45852%7c290&geo=us&id=&ie=11&site=33049&uid=gGnNQ4MmOM9LtEpU&usermuted=0&w=1122893834&langs=en Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: cdn.bitmedianetwork.com Connection: Keep-Alive
Jan 30, 2021 12:50:57.469976902 CET	700	IN	HTTP/1.1 200 OK x-amz-id-2: t1IlG63mSBvxjstGZCruChH+x002XJC0DBBDyWW2/jtao4+EseZX2B+tX5dSHJrPpMyznZ2k3Zg= x-amz-request-id: DF9A650343D29CB0 Content-Type: application/javascript Server: AmazonS3 X-LLID: 55257f222a1d37c5b83c8171d758ea01 Age: 38021 Date: Sat, 30 Jan 2021 11:50:57 GMT Last-Modified: Wed, 22 Jul 2020 23:27:00 GMT Expires: Sun, 31 Jan 2021 01:17:16 GMT Content-Length: 27501 Connection: keep-alive Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 4a 53 4f 4e 3b 69 66 28 21 4a 53 4f 4e 29 7b 4a 53 4f 4e 3d 7b 7d 7d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 66 75 6e 63 74 69 6f 6e 20 66 28 6e 29 7b 72 65 74 75 72 6e 20 6e 3c 31 30 3f 27 30 27 2b 6e 3a 6e 7d 69 66 28 74 79 70 65 6f 66 20 44 61 74 65 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 4a 53 4f 4e 21 3d 3d 27 66 75 6e 63 74 69 6f 6e 27 29 7b 44 61 74 65 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 4a 53 4f 4e 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 7b 72 65 74 75 72 6e 20 69 73 46 69 6e 69 74 65 28 74 68 69 73 2e 76 61 6c 75 65 4f 66 28 29 29 3f 74 68 69 73 2e 67 65 74 55 54 43 46 75 6c 6c 59 65 61 72 28 29 2b 27 2d 27 2b 66 28 74 68 69 73 2e 67 65 74 55 54 43 4d 6f 6e 74 68 28 29 2b 31 29 2b 27 2d 27 2b 66 28 74 68 69 73 2e 67 65 74 55 54 43 44 61 74 65 28 29 29 2b 27 54 27 2b 66 28 74 68 69 73 2e 67 65 74 55 54 43 48 6f 75 72 73 28 29 29 2b 27 3a 27 2b 66 28 74 68 69 73 2e 67 65 74 55 54 43 4d 69 6e 75 74 65 73 28 29 29 2b 27 3a 27 2b 66 28 74 68 69 73 2e 67 65 74 55 54 43 53 65 63 6f 6e 64 73 28 29 29 2b 27 5a 27 3a 6e 75 6c 6c 7d 3b 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 4a 53 4f 4e 3d 4e 75 6d 62 65 72 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 4a 53 4f 4e 3d 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 4a 53 4f 4e 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 76 61 6c 75 65 4f 66 28 29 7d 7d 76 61 72 20 63 78 3d 2f 5b 5c 75 30 30 30 30 5c 75 30 30 61 64 5c 75 30 36 30 30 2d 5c 75 30 36 30 34 5c 75 30 37 30 66 5c 75 31 37 62 34 5c 75 31 37 62 35 5c 75 32 30 30 63 2d 5c 75 32 30 30 66 5c 75 32 30 32 38 2d 5c 75 32 30 32 66 5c 75 32 30 36 30 2d 5c 75 32 30 36 66 5c 75 66 65 66 66 5c 75 66 66 66 30 2d 5c 75 66 66 66 66 5d 2f 67 2c 65 73 63 61 70 61 62 6c 65 3d 2f 5b 5c 5c 5c 22 5c 78 30 30 2d 5c 78 31 66 5c 78 37 66 2d 5c 78 39 66 5c 75 30 30 61 64 5c 75 30 36 30 30 2d 5c 75 30 36 30 34 5c 75 30 37 30 66 5c 75 31 37 62 34 5c 75 31 37 62 35 5c 75 32 30 30 63 2d 5c 75 32 30 30 66 5c 75 32 30 32 38 2d 5c 75 32 30 32 66 5c 75 32 30 36 30 2d 5c 75 32 30 36 66 5c 75 66 65 66 66 5c 75 66 66 66 30 2d 5c 75 66 66 66 66 5d 2f 67 2c 67 61 70 2c 69 6e 64 65 6e 74 2c 6d 65 74 61 3d 7b 27 5c 62 27 3a 27 5c 5c 62 27 2c 27 5c 74 27 3a 27 5c 5c 74 27 2c 27 5c 6e 27 3a 27 5c 5c 6e 27 2c 27 5c 66 27 3a 27 5c 5c 66 27 2c 27 5c 72 27 3a 27 5c 5c 72 27 2c 27 22 27 3a 27 5c 5c 22 27 2c 27 5c 5c 27 3a 27 5c 5c 5c 5c 27 7d 2c 72 65 70 3b 66 75 6e 63 74 69 6f 6e 20 71 75 6f 74 65 28 73 Data Ascii: (function(){var JSON;if(!JSON){JSON={}}(function(){'use strict';function f(n){return n<10?'0'+n:n}if(typeof Date.prototype.toJSON!=='function'){Date.prototype.toJSON=function(key){return isFinite(this.valueOf())?this.getUTCFullYear()+'-'+f(this.getUTCMonth()+1)+'-'+f(this.getUTCDate())+'T'+f(this.getUTCHours())+':'+f(this.getUTCMinutes())+':'+f(this.getUTCSeconds())+'Z':null};String.prototype.toJSON=Number.prototype.toJSON=Boolean.prototype.toJSON=function(key){return this.valueOf()}}var cx=/[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,escapable=/[\\\"\x00-\x1f\x7f-\x9f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,gap,indent,meta={'\b':'\\b','\t':'\\t','\n':'\\n','\f':'\\f','\r':'\\r','"':'\\"','\\':'\\\\'},rep;function quote(s
Jan 30, 2021 12:50:57.470021009 CET	701	IN	Data Raw: 74 72 69 6e 67 29 7b 65 73 63 61 70 61 62 6c 65 2e 6c 61 73 74 49 6e 64 65 78 3d 30 3b 72 65 74 75 72 6e 20 65 73 63 61 70 61 62 6c 65 2e 74 65 73 74 28 73 74 72 69 6e 67 29 3f 27 22 27 2b 73 74 72 69 6e 67 2e 72 65 70 6c 61 63 65 28 65 73 63 61 Data Ascii: tring){escapable.lastIndex=0;return escapable.test(string)?'"'+string.replace(escapable,function(a){var c=meta[a];return typeof c==='string'?c:'\\u'+('0000'+a.charCodeAt(0).toString(16)).slice(-4)})+'"':'"'+string+'"'}function str(key,holder){
Jan 30, 2021 12:50:57.470058918 CET	703	IN	Data Raw: 67 61 70 3d 6d 69 6e 64 3b 72 65 74 75 72 6e 20 76 7d 7d 69 66 28 74 79 70 65 6f 66 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 21 3d 3d 27 66 75 6e 63 74 69 6f 6e 27 29 7b 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: gap=mind;return v}}if(typeof JSON.stringify!=='function'){JSON.stringify=function(value,replacer,space){var i;gap='';indent='';if(typeof space==='number'){for(i=0;i<space;i+=1){indent+=' '}}else if(typeof space==='string'){indent=space}rep=rep
Jan 30, 2021 12:50:57.470098019 CET	704	IN	Data Raw: 75 65 73 74 44 61 74 61 2c 72 6f 6f 74 2c 7a 65 72 6b 45 76 65 6e 74 2c 73 6c 69 63 65 3d 5b 5d 2e 73 6c 69 63 65 2c 68 61 73 50 72 6f 70 3d 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 3b 72 6f 6f 74 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 Data Ascii: uestData,root,zerkEvent,slice=[].slice,hasProp={}.hasOwnProperty;root=typeof exports!=="undefined"&&exports!==null?exports:this;root.zerk_base64={_keyStr:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_=",decode:function(e){va
Jan 30, 2021 12:50:57.470134974 CET	705	IN	Data Raw: 74 75 72 6e 20 75 75 69 64 3b 7d 3b 72 6f 6f 74 2e 7a 65 72 6b 5f 67 65 74 51 75 65 72 79 56 61 72 69 61 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 75 72 6c 2c 76 61 72 69 61 62 6c 65 29 7b 76 61 72 20 69 2c 70 61 69 72 2c 71 75 65 72 79 2c 76 61 72 Data Ascii: turn uuid;};root.zerk_getQueryVariable=function(url,variable){var i,pair,query,vars;query=url.split("?")[1];vars=query.split("&");i=0;while(i<vars.length){pair=vars[i].split("=");if(pair[0]===variable){return pair[1];}i++;}return false;};roo
Jan 30, 2021 12:50:57.470185995 CET	707	IN	Data Raw: 72 20 68 65 61 64 2c 6e 65 77 53 63 72 69 70 74 3b 6e 65 77 53 63 72 69 70 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 6e 65 77 53 63 72 69 70 74 2e 74 79 70 65 3d 27 74 65 78 74 2f 6a Data Ascii: r head,newScript;newScript=document.createElement('script');newScript.type='text/javascript';newScript.src=url;head=document.getElementsByTagName('head')[0];return head.appendChild(newScript);};root.azRegisterExtension=function(name,func){var
Jan 30, 2021 12:50:57.470228910 CET	708	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 6e 65 77 53 63 72 69 70 74 2e 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3b 69 66 28 2f 6d 73 69 65 2f 2e 74 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f Data Ascii: "script");newScript.type="text/javascript";if(/msie/.test(navigator.userAgent.toLowerCase())){newScript.text=script;}else{newScript.innerHTML=script;}adzerkDiv=document.getElementById(div);return adzerkDiv.appendChild(newScript);};root.azLoad
Jan 30, 2021 12:50:57.470274925 CET	710	IN	Data Raw: 73 5f 73 65 74 49 50 3d 72 6f 6f 74 2e 61 64 6f 73 5f 73 65 74 49 70 3b 72 6f 6f 74 2e 61 64 6f 73 5f 73 65 74 55 73 65 72 41 67 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 75 61 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 61 64 6f 73 2e 75 73 65 Data Ascii: s_setIP=root.ados_setIp;root.ados_setUserAgent=function(ua){return window.ados.userAgentOverride=String(ua);};root.ados_setUser=function(userKey){return window.ados.userKeyOverride=String(userKey);};root.ados_setConsent=function(consent){retur
Jan 30, 2021 12:50:57.470319986 CET	711	IN	Data Raw: 29 7b 61 64 6f 73 5f 6c 6f 67 28 27 73 65 74 74 69 6e 67 20 74 69 6d 65 6f 75 74 27 2b 74 69 6d 65 6f 75 74 29 3b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 61 64 6f 73 2e 70 61 73 73 62 61 63 6b 54 69 6d 65 6f 75 74 3d 74 69 6d 65 6f 75 74 3b 7d Data Ascii: ){ados_log('setting timeout'+timeout);return window.ados.passbackTimeout=timeout;};root.ados_log=function(text){window.ados.fire('log',new logData(text));if(window.console){return console.info(new Date().getTime()+': '+text);}};root.ados_addPl
Jan 30, 2021 12:50:57.470357895 CET	713	IN	Data Raw: 65 72 41 67 65 6e 74 4f 76 65 72 72 69 64 65 3d 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 64 6f 73 2e 75 73 65 72 41 67 65 6e 74 4f 76 65 72 72 69 64 65 29 3b 7d 0a 69 66 28 77 69 6e 64 6f 77 2e 61 64 6f 73 2e 63 6f 6e 73 65 6e Data Ascii: erAgentOverride=encodeURIComponent(ados.userAgentOverride);}if(window.ados.consent!=null){this.Consent=window.ados.consent;}this.Keywords=encodeURIComponent(ados.keywords);this.Referrer=encodeURIComponent(document.referrer);this.IsAsync=wind
Jan 30, 2021 12:50:57.470393896 CET	714	IN	Data Raw: 65 71 2e 55 73 65 72 4b 65 79 4f 76 65 72 72 69 64 65 3b 7d 0a 69 66 28 72 65 71 2e 55 73 65 72 41 67 65 6e 74 4f 76 65 72 72 69 64 65 21 3d 6e 75 6c 6c 29 7b 74 68 69 73 2e 75 73 65 72 41 67 65 6e 74 4f 76 65 72 72 69 64 65 3d 72 65 71 2e 55 73 Data Ascii: eq.UserKeyOverride;}if(req.UserAgentOverride!=null){this.userAgentOverride=req.UserAgentOverride;}if(req.Consent!=null){this.consent=req.Consent;}if(req.Keywords){this.keywords=req.Keywords;}if(req.Referrer){this.referrer=req.Referrer;}re

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.3	49935	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:05.327169895 CET	11470	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:05.381515980 CET	11472	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: aa70f8e2ac6849e44226593406b71938 Age: 38090 Date: Sat, 30 Jan 2021 11:52:05 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:05.381562948 CET	11473	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:05.381607056 CET	11474	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:05.381652117 CET	11476	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:05.381695986 CET	11477	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:05.381733894 CET	11478	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:05.381769896 CET	11479	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.3	49936	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:05.542546988 CET	11480	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:05.597872019 CET	11481	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: c0d1f89bd82678db2d04e0732d57277e Age: 38090 Date: Sat, 30 Jan 2021 11:52:05 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:05.597923040 CET	11483	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:05.597971916 CET	11484	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:05.598045111 CET	11486	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:05.598098993 CET	11487	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:05.598156929 CET	11488	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:05.598198891 CET	11489	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.3	49937	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:06.061950922 CET	11490	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:06.115204096 CET	11491	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 416beb9859575ac5c1e04a87dab42eff Age: 38091 Date: Sat, 30 Jan 2021 11:52:06 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:06.115258932 CET	11492	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:06.115315914 CET	11494	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:06.115375042 CET	11495	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:06.115426064 CET	11497	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:06.115484953 CET	11498	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:06.115528107 CET	11499	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.3	49938	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:06.270586014 CET	11499	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:06.323189974 CET	11501	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 38ac0c7187425c88e367edcdaa8086d0 Age: 38091 Date: Sat, 30 Jan 2021 11:52:06 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:52:06.323250055 CET	11502	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:52:06.323299885 CET	11503	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:52:06.323350906 CET	11505	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:52:06.323400021 CET	11506	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:52:06.323450089 CET	11508	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:52:06.323492050 CET	11508	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.3	49939	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:52:06.509459972 CET	11509	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:52:06.563169003 CET	11510	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 0bb0722d316f09503553ecbacfbaabd4 Age: 38091 Date: Sat, 30 Jan 2021 11:52:06 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.3	49940	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.3	49941	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.3	49942	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.3	49943	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.3	49944	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49747	54.197.251.114	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:57.509234905 CET	773	OUT	POST /e?i=64 HTTP/1.1 Host: i-64.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 199 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 39 36 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 68 65 6c 70 65 72 5f 73 75 70 70 6f 72 74 22 2c 22 61 63 74 69 6f 6e 22 3a 22 76 33 2e 34 35 38 35 32 2e 73 74 61 74 75 73 2e 65 6e 61 62 6c 65 64 22 2c 22 68 76 22 3a 22 75 6e 6b 6e 6f 77 6e 22 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039896,"eventName":"helper_support","action":"v3.45852.status.enabled","hv":"unknown"}
Jan 30, 2021 12:50:57.641062021 CET	849	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:57 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.3	49945	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.3	49946	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.3	49947	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.3	49948	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.3	49950	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.3	49951	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.3	49952	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.3	49953	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.3	49954	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.3	49955	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49748	54.197.251.114	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:57.847450972 CET	850	OUT	POST /e?i=62 HTTP/1.1 Host: i-62.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 174 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 39 36 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6f 6f 6b 69 65 5f 73 79 6e 63 22 2c 22 61 63 74 69 6f 6e 22 3a 22 72 65 71 75 65 73 74 5f 69 64 2e 34 35 38 35 32 22 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039896,"eventName":"cookie_sync","action":"request_id.45852"}
Jan 30, 2021 12:50:57.975632906 CET	850	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:57 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.3	49956	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.3	49957	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.3	49958	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.3	49959	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.3	49960	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.3	49961	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.3	49962	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.3	49963	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.3	49964	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.3	49965	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49749	54.243.113.215	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:58.172425032 CET	852	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 39 36 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039896,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:50:58.299338102 CET	852	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:58 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.3	49966	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.3	49967	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.3	49968	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.3	49969	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.3	49970	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.3	49971	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.3	49972	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.3	49973	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.3	49974	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.3	49975	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49752	54.197.251.114	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:58.495243073 CET	855	OUT	POST /e?i=38 HTTP/1.1 Host: i-38.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 225 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 39 37 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 50 61 67 65 52 65 71 75 65 73 74 65 64 22 2c 22 64 61 74 65 22 3a 22 32 30 32 31 2d 30 31 2d 33 30 22 2c 22 74 69 6d 65 22 3a 22 31 32 3a 35 31 3a 33 35 22 2c 22 67 65 6f 22 3a 22 75 73 22 2c 22 73 69 74 65 69 64 22 3a 22 33 33 30 34 39 22 2c 22 61 64 74 79 70 65 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039897,"eventName":"PageRequested","date":"2021-01-30","time":"12:51:35","geo":"us","siteid":"33049","adtype":0}
Jan 30, 2021 12:50:58.622387886 CET	867	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:58 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.3	49976	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.3	49977	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.3	49978	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.3	49979	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.3	49980	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.3	49981	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.3	49983	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.3	49982	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.3	49984	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.3	49985	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49753	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:58.734328032 CET	868	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:50:58.787894964 CET	869	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 7107d8ad448695c73e714f2a9bd6870a Age: 38023 Date: Sat, 30 Jan 2021 11:50:58 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:50:58.787934065 CET	871	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:50:58.787971973 CET	872	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:50:58.788008928 CET	874	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:50:58.788048029 CET	875	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:50:58.788086891 CET	876	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:50:58.788127899 CET	877	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.3	49986	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.3	49987	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.3	49988	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49732	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:40.357351065 CET	632	OUT	GET /utorrent-onboarding/player.btapp HTTP/1.1 Host: apps.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Connection: Close
Jan 30, 2021 12:50:40.411926985 CET	633	IN	HTTP/1.1 403 Forbidden x-amz-request-id: 7DB30AE65C94DBCC x-amz-id-2: taSNk4nYKR5r1xYFm1ZVY9DUBGwqJRa3htkt2jNb65LGuI5ANzB6+tkAkEWeboDKPASqFGoiVGs= Content-Type: application/xml Server: AmazonS3 Age: 365 Date: Sat, 30 Jan 2021 11:50:40 GMT Expires: Sat, 30 Jan 2021 12:14:41 GMT X-LLID: f2e0d30a3f3aa9d11c9e206029cfcbc3 Connection: close Cache-Control: max-age=86400 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 37 44 42 33 30 41 45 36 35 43 39 34 44 42 43 43 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 74 61 53 4e 6b 34 6e 59 4b 52 35 72 31 78 59 46 6d 31 5a 56 59 39 44 55 42 47 77 71 4a 52 61 33 68 74 6b 74 32 6a 4e 62 36 35 4c 47 75 49 35 41 4e 7a 42 36 2b 74 6b 41 6b 45 57 65 62 6f 44 4b 50 41 53 71 46 47 6f 69 56 47 73 3d 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 72 6f 72 3e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>7DB30AE65C94DBCC</RequestId><HostId>taSNk4nYKR5r1xYFm1ZVY9DUBGwqJRa3htkt2jNb65LGuI5ANzB6+tkAkEWeboDKPASqFGoiVGs=</HostId></Error>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49754	54.243.113.215	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:58.842248917 CET	878	OUT	POST /e?i=62 HTTP/1.1 Host: i-62.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 170 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 39 37 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6f 6f 6b 69 65 5f 73 79 6e 63 22 2c 22 61 63 74 69 6f 6e 22 3a 22 6f 70 65 6e 5f 72 2e 34 35 38 35 32 22 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039897,"eventName":"cookie_sync","action":"open_r.45852"}
Jan 30, 2021 12:50:58.971245050 CET	880	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:58 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49755	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:58.982105970 CET	881	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:50:59.038240910 CET	882	IN	HTTP/1.1 200 OK x-amz-id-2: E9EOQbeGIQ7BBLGvXhyxL1v2L3BUISNAdf/0cylPZjVIqMWt702lDO43mvo7OFXRJLMBENU6yBU= x-amz-request-id: 043AA3F0ECC70C0B Content-Type: application/json Server: AmazonS3 X-LLID: c96077c50d28cc5457639040175b7055 Age: 38024 Date: Sat, 30 Jan 2021 11:50:59 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:50:59.038289070 CET	884	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:50:59.038327932 CET	885	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:50:59.038367033 CET	886	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:50:59.038404942 CET	888	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:50:59.038440943 CET	889	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:50:59.038474083 CET	890	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49756	54.243.113.215	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:59.431024075 CET	892	OUT	POST /e?i=67 HTTP/1.1 Host: i-67.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 156 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 39 37 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 44 4c 69 76 65 22 2c 22 61 63 74 69 6f 6e 22 3a 22 73 68 6f 77 22 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039897,"eventName":"DLive","action":"show"}
Jan 30, 2021 12:50:59.572419882 CET	902	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:59 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49757	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:59.486192942 CET	892	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:50:59.539519072 CET	894	IN	HTTP/1.1 200 OK x-amz-id-2: vkOXIZTjqeBrxo7PlYpk13XD5FYWwf2Z2nrOFbNRiHzK06OYFlPRMFPK+KsTCHRe137oSi2uSQE= x-amz-request-id: 95C12C3C0C5219AA Content-Type: application/json Server: AmazonS3 X-LLID: 9e1d8d0a4acbd30337de3ce4e609d2ad Age: 38024 Date: Sat, 30 Jan 2021 11:50:59 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:50:59.539566040 CET	895	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:50:59.539608002 CET	896	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:50:59.539645910 CET	898	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:50:59.539686918 CET	899	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:50:59.539741993 CET	900	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:50:59.539773941 CET	901	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49758	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:59.731627941 CET	903	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:50:59.784324884 CET	904	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: dc83025169824637c80f345adc138e04 Age: 38024 Date: Sat, 30 Jan 2021 11:50:59 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:50:59.784375906 CET	906	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:50:59.784427881 CET	907	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:50:59.784476042 CET	908	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:50:59.784534931 CET	910	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:50:59.784585953 CET	911	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:50:59.784625053 CET	912	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49759	54.197.251.114	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:59.866168976 CET	912	OUT	POST /e?i=62 HTTP/1.1 Host: i-62.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 174 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 39 38 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6f 6f 6b 69 65 5f 73 79 6e 63 22 2c 22 61 63 74 69 6f 6e 22 3a 22 72 65 71 75 65 73 74 5f 69 64 2e 34 35 38 35 32 22 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039898,"eventName":"cookie_sync","action":"request_id.45852"}
Jan 30, 2021 12:50:59.993320942 CET	913	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:59 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49760	98.143.146.7	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:00.252202034 CET	914	OUT	GET /prodnews?v=3%2e5%2e5%2e1%2e45852 HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: utorrent.com Connection: Keep-Alive
Jan 30, 2021 12:51:00.432115078 CET	925	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.4.7 Date: Sat, 30 Jan 2021 11:51:00 GMT Content-Type: text/html Content-Length: 184 Connection: keep-alive Location: http://www.utorrent.com/prodnews?v=3%2e5%2e5%2e1%2e45852 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 34 2e 37 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.4.7</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49762	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:00.294020891 CET	915	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:00.349107981 CET	916	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 91ed119379e56d3a1e66d0a536796dc2 Age: 38025 Date: Sat, 30 Jan 2021 11:51:00 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:00.349198103 CET	917	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:00.349261045 CET	919	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:00.349315882 CET	920	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:00.349366903 CET	922	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:00.349481106 CET	923	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:00.349529028 CET	924	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49763	54.243.113.215	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:00.428190947 CET	924	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 39 39 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039899,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:00.567274094 CET	926	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:00 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49764	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:00.530931950 CET	925	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:00.584537983 CET	928	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 3843b5d1ea72c78f710c230eb1e96b1e Age: 38025 Date: Sat, 30 Jan 2021 11:51:00 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:00.584616899 CET	929	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:00.584667921 CET	930	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:00.584716082 CET	932	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:00.584772110 CET	933	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:00.584821939 CET	935	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:00.584861994 CET	935	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49733	107.22.221.32	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:40.783230066 CET	634	OUT	POST /e?i=67 HTTP/1.1 Host: i-67.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 156 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 36 39 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 44 4c 69 76 65 22 2c 22 61 63 74 69 6f 6e 22 3a 22 68 69 64 65 22 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039869,"eventName":"DLive","action":"hide"}
Jan 30, 2021 12:50:40.911871910 CET	635	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:40 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49765	178.79.242.16	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:00.622478008 CET	936	OUT	GET /prodnews?v=3%2e5%2e5%2e1%2e45852 HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: www.utorrent.com
Jan 30, 2021 12:51:00.676990032 CET	937	IN	HTTP/1.1 301 Moved Permanently Server: EdgePrism/4.8.4.0 Date: Sat, 30 Jan 2021 11:51:00 GMT Location: https://www.utorrent.com/prodnews?v=3%2e5%2e5%2e1%2e45852 X-LLID: 5d8169ebbdba839963bf6feee347bb27 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49767	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:00.776796103 CET	937	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:00.831510067 CET	939	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 07497d1d673bcd7bf0747493f7fde5c4 Age: 38025 Date: Sat, 30 Jan 2021 11:51:00 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:00.831549883 CET	940	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:00.831595898 CET	942	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:00.831638098 CET	943	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:00.831675053 CET	944	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:00.831712008 CET	946	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:00.831743002 CET	946	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49768	54.243.113.215	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:00.847676039 CET	947	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 157 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 39 39 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 4c 52 65 63 41 64 22 2c 22 63 6c 6f 73 65 4c 52 65 63 41 64 22 3a 31 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039899,"eventName":"LRecAd","closeLRecAd":1}
Jan 30, 2021 12:51:00.974508047 CET	953	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:00 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49770	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:01.102628946 CET	1000	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:01.158286095 CET	1095	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: dab2f40f7dd333e0dcea55520d636e1f Age: 38026 Date: Sat, 30 Jan 2021 11:51:01 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:01.158330917 CET	1096	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:01.158366919 CET	1098	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:01.158415079 CET	1099	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:01.158472061 CET	1100	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:01.158516884 CET	1102	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:01.158551931 CET	1102	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49775	54.243.113.215	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:01.497874975 CET	1446	OUT	POST /e?i=38 HTTP/1.1 Host: i-38.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 227 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 39 39 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 50 61 67 65 52 65 71 75 65 73 74 65 64 22 2c 22 64 61 74 65 22 3a 22 32 30 32 31 2d 30 31 2d 33 30 22 2c 22 74 69 6d 65 22 3a 22 31 32 3a 35 31 3a 33 37 22 2c 22 67 65 6f 22 3a 22 75 73 22 2c 22 73 69 74 65 69 64 22 3a 22 33 33 30 34 39 22 2c 22 61 64 74 79 70 65 22 3a 33 38 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039899,"eventName":"PageRequested","date":"2021-01-30","time":"12:51:37","geo":"us","siteid":"33049","adtype":380}
Jan 30, 2021 12:51:01.626749039 CET	1796	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:01 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49790	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:04.036195993 CET	4002	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:04.091608047 CET	4010	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 89fab2b9c5c1ba5d85a1403da93cd0b1 Age: 38029 Date: Sat, 30 Jan 2021 11:51:04 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:04.091659069 CET	4011	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:04.091727018 CET	4013	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:04.091784954 CET	4014	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:04.091862917 CET	4015	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:04.091914892 CET	4017	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:04.091963053 CET	4017	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49813	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:04.339989901 CET	4063	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:04.397372961 CET	4064	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: de1cd2c73b36561b9bf1b5c3449f5f5b Age: 38029 Date: Sat, 30 Jan 2021 11:51:04 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:04.397461891 CET	4066	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:04.397521973 CET	4067	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:04.397584915 CET	4068	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:04.397645950 CET	4070	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:04.397706985 CET	4071	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:04.397761106 CET	4072	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49815	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:04.844106913 CET	4498	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:04.898322105 CET	4537	IN	HTTP/1.1 200 OK x-amz-id-2: Zv9XDWbxSozlTzZuej7sV4WivB9mduk5w1fVFZLF3Xeq3brECX+1Vy3YykQxRQe8Z2ucLYfuzME= x-amz-request-id: EBF5C922B13C3D4B Content-Type: application/json Server: AmazonS3 X-LLID: 81b870b3c4ce14199cc9f13154e8c42c Age: 38029 Date: Sat, 30 Jan 2021 11:51:04 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:04.898382902 CET	4538	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:04.898459911 CET	4539	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:04.898538113 CET	4541	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:04.898639917 CET	4542	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:04.898690939 CET	4544	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:04.898787975 CET	4544	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49817	178.79.242.181	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:04.885407925 CET	4535	OUT	GET /partners/didomi/client-cmp-ut.min.html?langs=en HTTP/1.1 Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: video.trontv.com Connection: Keep-Alive
Jan 30, 2021 12:51:04.938895941 CET	4546	IN	HTTP/1.1 200 OK x-amz-id-2: N4LC1TDLjW/c3B/TBDEhxcC5AHPrMi48MsOdo7nDU2vVvMceGuDmBCkToHH9mNO5+ms+cQipMFo= x-amz-request-id: D0A3160C28821AE7 Content-Type: text/html Server: AmazonS3 X-LLID: 036935968fa2f88d1aa1e20871754697 Age: 4192 Date: Sat, 30 Jan 2021 11:51:04 GMT Last-Modified: Sat, 30 Jan 2021 01:17:12 GMT Content-Length: 7699 X-IP-Address: 178.79.244.47 Connection: keep-alive Access-Control-Allow-Origin: * Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 2e 67 64 70 72 41 70 70 6c 69 65 73 47 6c 6f 62 61 6c 6c 79 3d 66 61 6c 73 65 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 69 66 28 21 77 69 6e 64 6f 77 2e 66 72 61 6d 65 73 5b 65 5d 29 7b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 26 26 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 66 69 72 73 74 43 68 69 6c 64 29 7b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 6e 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 3b 6e 2e 6e 61 6d 65 3d 65 3b 6e 2e 74 69 74 6c 65 3d 65 3b 74 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 6e 2c 74 2e 66 69 72 73 74 43 68 69 6c 64 29 7d 20 65 6c 73 65 7b 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 61 28 65 29 7d 2c 35 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 28 6e 2c 72 2c 6f 2c 63 2c 73 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6e 2c 61 29 7b 69 66 28 74 79 70 65 6f 66 20 6e 21 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 72 65 74 75 72 6e 7d 69 66 28 21 77 69 6e 64 6f 77 5b 72 5d 29 7b 77 69 6e 64 6f 77 5b 72 5d 3d 5b 5d 7d 76 61 72 20 69 3d 66 61 6c 73 65 3b 69 66 28 73 29 7b 69 3d 73 28 65 2c 74 2c 6e 29 7d 69 66 28 21 69 29 7b 77 69 6e 64 6f 77 5b 72 5d 2e 70 75 73 68 28 7b 63 6f 6d 6d 61 6e 64 3a 65 2c 70 61 72 61 6d 65 74 65 72 3a 74 2c 63 61 6c 6c 62 61 63 6b 3a 6e 2c 76 65 72 73 69 6f 6e 3a 61 7d 29 7d 7d 65 2e 73 74 75 62 3d 74 72 75 65 3b 66 75 6e 63 74 69 6f 6e 20 74 28 61 29 7b 69 66 28 21 77 69 6e 64 6f 77 5b 6e 5d 7c 7c 77 69 6e 64 6f 77 5b 6e 5d 2e 73 74 75 62 21 3d 3d 74 72 75 65 29 7b 72 65 74 75 72 6e 7d 69 66 28 21 61 2e 64 61 74 61 29 7b 72 65 74 75 72 6e 7d 20 76 61 72 20 69 3d 74 79 70 65 6f 66 20 61 2e 64 61 74 61 3d 3d 3d 22 73 74 72 69 6e 67 22 3b 76 61 72 20 65 3b 74 72 79 7b 65 3d 69 3f 4a 53 4f 4e 2e 70 61 72 73 65 28 61 2e 64 61 74 61 29 3a 61 2e 64 61 74 61 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 7d 69 66 28 65 5b 6f 5d 29 7b 76 61 72 20 72 3d 65 5b 6f 5d 3b 77 69 6e 64 6f 77 5b 6e 5d 28 72 2e 63 6f 6d 6d 61 6e 64 2c 72 2e 70 61 72 61 6d 65 74 65 72 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 7b 7d 3b 6e 5b 63 5d 3d 7b 72 65 74 75 72 6e 56 61 6c 75 65 3a 65 2c 73 75 63 63 65 73 73 3a 74 2c 63 61 6c 6c 49 64 3a 72 2e 63 61 6c 6c 49 64 7d 3b 61 2e 73 6f 75 72 63 65 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 69 3f 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 6e 29 3a 6e 2c 22 2a 22 29 7d 2c 72 2e 76 Data Ascii: <!DOCTYPE html><html><head><script type="text/javascript">window.gdprAppliesGlobally=false;(function(){function a(e){if(!window.frames[e]){if(document.body&&document.body.firstChild){var t=document.body;var n=document.createElement("iframe");n.style.display="none";n.name=e;n.title=e;t.insertBefore(n,t.firstChild)} else{setTimeout(function(){a(e)},5)}}}function e(n,r,o,c,s){function e(e,t,n,a){if(typeof n!=="function"){return}if(!window[r]){window[r]=[]}var i=false;if(s){i=s(e,t,n)}if(!i){window[r].push({command:e,parameter:t,callback:n,version:a})}}e.stub=true;function t(a){if(!window[n]\|\|window[n].stub!==true){return}if(!a.data){return} var i=typeof a.data==="string";var e;try{e=i?JSON.parse(a.data):a.data}catch(t){return}if(e[o]){var r=e[o];window[n](r.command,r.parameter,function(e,t){var n={};n[c]={returnValue:e,success:t,callId:r.callId};a.source.postMessage(i?JSON.stringify(n):n,"*")},r.v
Jan 30, 2021 12:51:04.938951015 CET	4548	IN	Data Raw: 65 72 73 69 6f 6e 29 7d 7d 20 69 66 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 5b 6e 5d 21 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 77 69 6e 64 6f 77 5b 6e 5d 3d 65 3b 69 66 28 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 Data Ascii: ersion)}} if(typeof window[n]!=="function"){window[n]=e;if(window.addEventListener){window.addEventListener("message",t,false)}else{window.attachEvent("onmessage",t)}}}e("__tcfapi","__tcfapiBuffer","__tcfapiCall","__tcfapiReturn");a("__tcfapiL
Jan 30, 2021 12:51:04.939001083 CET	4549	IN	Data Raw: 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 7c 7c 5b 5d 3b 77 69 6e 64 6f 77 2e 64 69 64 6f 6d 69 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 2e 70 75 73 68 28 7b 65 76 65 6e 74 3a 27 70 72 65 66 65 72 65 6e 63 65 73 2e 63 6c 69 63 6b 73 61 76 65 63 68 Data Ascii: ventListeners\|\|[];window.didomiEventListeners.push({event:'preferences.clicksavechoices',listener:function(){window.external.close(0)}},{event:'preferences.clickclose',listener:function(){if(window.forceprefs){window.external.close(0)}}},{even
Jan 30, 2021 12:51:04.939049959 CET	4550	IN	Data Raw: 2e 64 69 64 6f 6d 69 2d 63 6f 6e 73 65 6e 74 2d 70 6f 70 75 70 2d 68 65 61 64 65 72 7b 66 6f 6e 74 3a 32 34 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 53 65 67 6f 65 20 55 49 27 2c 20 54 61 68 6f 6d 61 2c 20 Data Ascii: .didomi-consent-popup-header{font:24px !important;font-family:'Segoe UI', Tahoma, Geneva, Verdana, sans-serif !important;padding:32px 32px 0 !important;font-weight:600 !important}#didomi-host .didomi-popup-notice .didomi-popup-notice-buttons{m
Jan 30, 2021 12:51:04.939105988 CET	4552	IN	Data Raw: 6e 67 3a 33 32 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 64 69 64 6f 6d 69 2d 68 6f 73 74 20 2e 64 69 64 6f 6d 69 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 72 61 64 69 6f 5f 5f 6f 70 74 69 6f 6e 7b 68 65 69 67 68 74 3a 32 34 70 78 20 21 69 6d 70 6f Data Ascii: ng:32px !important}#didomi-host .didomi-components-radio__option{height:24px !important;margin-right:8px !important;border:2px solid #9B9B9B !important;font-size:16px !important;border-radius:4px !important;padding:4px 24px !important;box-shad
Jan 30, 2021 12:51:04.939155102 CET	4553	IN	Data Raw: 69 6e 6b 2d 73 74 79 6c 65 29 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 63 6f 6c 6f 72 3a 23 33 46 39 35 46 44 20 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 20 21 69 6d 70 Data Ascii: ink-style){text-decoration:underline;color:#3F95FD !important;font-weight:700 !important}#didomi-host a,#didomi-host p{font-size:16px !important;color:inherit;font-weight:normal;line-height:24px !important}#didomi-host .didomi-components-accor
Jan 30, 2021 12:51:04.939197063 CET	4553	IN	Data Raw: 64 69 64 6f 6d 69 2d 6e 6f 74 69 63 65 2e 64 69 64 6f 6d 69 2d 72 65 67 75 6c 61 72 2d 6e 6f 74 69 63 65 20 23 74 65 78 74 7b 6d 61 72 67 69 6e 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e Data Ascii: didomi-notice.didomi-regular-notice #text{margin:0;text-align:left}</style></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49818	67.215.246.203	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:05.031212091 CET	4769	OUT	GET /checkupdate.php?s=1&cl=uTorrent&v=111915804&i=64&l=en&svp=4&svn_revno=45852&tk=stable34&cmp=290&ocmp=290&period=8&sids=0,0,0,0,0&lv=4308514_0_&c=US&w=42EE000A&h=gGnNQ4MmOM9LtEpU&mts=31&gnc=1&nat_state=255&pc=12&sctl=1&shdi=1&def_tor=1&w64=1&skn=1&doainstalled=0&ie=9.11.17134.0&xim=1&sss=107&rtsb=107&view=win32&cmp=290&ocmp=290&db=ie&plus=3&pupsell=1&adc=1&ch_up=1?fg=1000&t_upP_=22937&t_downP_=79344&ssb=13256513503&ssu=13256513503&xseq=0&cau_time=0 HTTP/1.1 Host: update.utorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Connection: Close
Jan 30, 2021 12:51:05.210161924 CET	5194	IN	HTTP/1.1 200 OK Server: nginx/1.4.7 Date: Sat, 30 Jan 2021 12:03:37 GMT Content-Type: text/html Content-Length: 512 Connection: close X-Powered-By: PHP/5.4.30 Expires: Thu, 21 Jul 1980 00:00:00 GMT Cache-Control: private Last-Modified: Sat, 30 Jan 2021 12:03:37 GMT Data Raw: 64 31 30 3a 61 64 73 45 6e 61 62 6c 65 64 69 31 65 31 33 3a 66 62 6c 69 6b 65 45 6e 61 62 6c 65 64 69 30 65 31 34 3a 74 77 69 74 74 65 72 45 6e 61 62 6c 65 64 69 30 65 31 33 3a 61 64 52 65 66 72 65 73 68 52 61 74 65 69 33 36 30 65 39 3a 66 74 45 6e 61 62 6c 65 64 69 31 65 31 31 3a 6c 72 65 63 45 6e 61 62 6c 65 64 69 31 65 31 34 3a 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 69 30 65 31 39 3a 73 70 65 63 69 61 6c 4f 66 66 65 72 45 6e 61 62 6c 65 64 69 30 65 32 32 3a 6f 66 66 65 72 52 6f 6c 6c 6f 75 74 4c 61 62 45 6e 61 62 6c 65 64 69 31 65 31 37 3a 74 72 61 79 4f 66 66 65 72 49 6d 61 67 65 55 72 6c 35 31 3a 68 74 74 70 3a 2f 2f 75 74 63 6c 69 65 6e 74 2e 75 74 6f 72 72 65 6e 74 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 6d 6f 62 69 6c 65 2d 69 63 6f 6e 2e 70 6e 67 31 38 3a 74 72 61 79 4f 66 66 65 72 54 61 72 67 65 74 55 72 6c 32 31 3a 68 74 74 70 3a 2f 2f 62 69 74 2e 6c 79 2f 31 68 6b 6e 47 48 49 32 32 3a 74 72 61 79 4f 66 66 65 72 48 6f 76 65 72 4f 76 65 72 54 65 78 74 32 33 3a 75 54 6f 72 72 65 6e 74 20 41 6e 64 72 6f 69 64 20 43 6c 69 65 6e 74 31 37 3a 74 72 61 79 4f 66 66 65 72 4f 6e 65 43 6c 69 63 6b 69 30 65 31 30 3a 73 65 61 72 63 68 55 72 6c 73 37 35 3a 53 6d 61 72 74 20 53 65 61 72 63 68 7c 68 74 74 70 73 3a 2f 2f 6d 65 64 69 61 2e 61 64 61 77 61 72 65 2e 63 6f 6d 2f 74 6f 72 72 65 6e 74 73 63 61 6e 6e 65 72 2f 6c 70 2f 73 65 61 72 63 68 2e 70 68 70 3f 70 3d 62 74 26 71 3d 31 3a 6b 30 3a 32 3a 69 70 31 31 3a 38 34 2e 31 37 2e 35 32 2e 37 34 32 3a 74 73 69 31 36 31 32 30 30 38 32 31 37 65 31 3a 63 32 3a 63 68 65 Data Ascii: d10:adsEnabledi1e13:fblikeEnabledi0e14:twitterEnabledi0e13:adRefreshRatei360e9:ftEnabledi1e11:lrecEnabledi1e14:sendConversioni0e19:specialOfferEnabledi0e22:offerRolloutLabEnabledi1e17:trayOfferImageUrl51:http://utclient.utorrent.com/images/mobile-icon.png18:trayOfferTargetUrl21:http://bit.ly/1hknGHI22:trayOfferHoverOverText23:uTorrent Android Client17:trayOfferOneClicki0e10:searchUrls75:Smart Search\|https://media.adaware.com/torrentscanner/lp/search.php?p=bt&q=1:k0:2:ip11:84.17.52.742:tsi1612008217e1:c2:che

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49734	107.22.221.32	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:42.213516951 CET	658	OUT	POST /e?i=29 HTTP/1.1 Host: i-29.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 201 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 37 30 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 64 69 6d 65 6e 73 69 6f 6e 73 22 2c 20 22 61 70 70 73 69 7a 65 22 3a 20 5b 20 31 31 31 38 2c 20 36 33 35 20 5d 2c 20 22 73 63 72 65 65 6e 73 69 7a 65 22 3a 20 5b 20 31 32 38 30 2c 20 31 30 32 34 20 5d 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039870,"eventName":"dimensions", "appsize": [ 1118, 635 ], "screensize": [ 1280, 1024 ]}
Jan 30, 2021 12:50:42.340085030 CET	660	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:42 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49821	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:05.124577045 CET	4998	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:05.184777975 CET	5179	IN	HTTP/1.1 200 OK x-amz-id-2: lhxD38bNXtJ5bQTIbEdMzRBnak+sm+nn2A2b8Ke7o53bhup+BRYZfu4E48Z9v/889+tUr0+YAy8= x-amz-request-id: 770EAECEAC544072 Content-Type: application/json Server: AmazonS3 X-LLID: 953c1892f2e23c0644411155c9a9c049 Age: 38030 Date: Sat, 30 Jan 2021 11:51:05 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:05.184818983 CET	5180	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:05.184871912 CET	5181	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:05.184914112 CET	5183	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:05.184953928 CET	5184	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:05.185003042 CET	5186	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:05.185038090 CET	5186	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49826	178.79.242.16	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:06.962430954 CET	5494	OUT	GET /helper_ui/helper_web_ui.btinstall HTTP/1.1 Host: btinstall-artifacts.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Content-Type: application/x-www-form-urlencoded Connection: Close
Jan 30, 2021 12:51:07.017225027 CET	5509	IN	HTTP/1.1 200 OK x-amz-id-2: HyilXiFtOXAsln92CQqL/dAHcjYSH+NZKKPeIo4bscF/0otjHq+htbtggk5O8KuHu3fE4RhlOKA= x-amz-request-id: CB480E447BBB2D30 Content-Type: binary/octet-stream Server: AmazonS3 X-LLID: 3b3ebb0bab65070eb1152e6fc546d602 Age: 24201 Date: Sat, 30 Jan 2021 11:51:07 GMT Last-Modified: Wed, 13 Jan 2021 22:50:48 GMT Content-Length: 4901304 Connection: close Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 d0 9d 9a 67 b1 f3 c9 67 b1 f3 c9 67 b1 f3 c9 6e c9 60 c9 72 b1 f3 c9 67 b1 f2 c9 c1 b1 f3 c9 79 e3 66 c9 61 b1 f3 c9 6e c9 70 c9 6e b1 f3 c9 6e c9 77 c9 42 b1 f3 c9 6e c9 61 c9 66 b1 f3 c9 6e c9 67 c9 66 b1 f3 c9 6e c9 62 c9 66 b1 f3 c9 52 69 63 68 67 b1 f3 c9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 16 1d e1 4d 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ce 00 00 00 3a 02 00 00 00 00 00 fd 9a 00 00 00 10 00 00 00 e0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 40 03 00 00 04 00 00 1a ab 4b 00 02 00 00 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 fa 00 00 33 00 00 00 d4 ec 00 00 c8 00 00 00 00 f0 02 00 78 40 00 00 00 00 00 00 00 00 00 00 d8 8e 4a 00 e0 3a 00 00 00 00 00 00 00 00 00 00 90 e2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 90 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 4b cc 00 00 00 10 00 00 00 ce 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 75 1b 00 00 00 e0 00 00 00 1c 00 00 00 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d8 d9 01 00 00 00 01 00 00 02 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 10 00 00 00 00 e0 02 00 00 02 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 40 00 00 00 f0 02 00 00 42 00 00 00 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$#gggn`rgyfanpnnwBnafngfnbfRichgPELM:@@K3x@J:.textK `.rdatau@@.data@.CRT@@.rsrcx@B@@
Jan 30, 2021 12:51:07.017281055 CET	5510	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 f9 40 73 16 80 f9 20 73 06 0f ad d0 d3 fa c3 8b Data Ascii: @s sD$L$L$uD$SD$d$D$[WVS3D$}GT$D$T$D$}GT$D$T$u
Jan 30, 2021 12:51:07.017323971 CET	5512	IN	Data Raw: 6b 80 00 00 bb 00 04 00 00 3b c3 73 6b 8d 86 30 04 00 00 50 e8 8a 82 00 00 3b c3 73 5b 8a 46 08 24 e0 3c e0 0f 94 c0 33 db 43 53 6a 00 88 45 f8 ff 75 f8 8b cf ff 75 08 e8 57 ff ff ff 84 c0 75 37 8b 8f f4 4e 00 00 e8 ad b5 00 00 eb 13 ff 75 10 ff Data Ascii: k;sk0P;s[F$<3CSjEuuWu7Nuuu[u!CNEPEPu3_^[utuuySUVWN3;tWJYN;tW2YN;tWYO
Jan 30, 2021 12:51:07.017364025 CET	5513	IN	Data Raw: ec 00 08 00 00 80 3d d0 04 41 00 00 56 8b f1 75 30 68 00 04 00 00 8d 85 00 f8 ff ff 50 ff 75 0c ff 75 08 e8 59 5b 00 00 8d 85 00 f8 ff ff 50 6a 76 e8 3d 78 00 00 50 6a 00 e8 29 8b 00 00 83 c4 0c 6a 02 8b ce e8 58 ff ff ff 5e c9 c2 08 00 55 8b ec Data Ascii: =AVu0hPuuY[Pjv=xPj)jX^U=AVu3hPuu[PhwPjj^UVVPuuZVPuuZPjmwP
Jan 30, 2021 12:51:07.017445087 CET	5515	IN	Data Raw: 58 15 42 00 eb 05 e8 17 23 00 00 83 f8 ff 0f 84 81 00 00 00 83 3d 4c 16 42 00 00 75 78 8b 0d 74 16 42 00 88 01 ff 05 74 16 42 00 ff 05 78 16 42 00 39 1d 78 16 42 00 75 a2 ff 35 84 15 42 00 a1 48 15 41 00 ff 35 80 15 42 00 8b 08 8b 40 04 03 fb 83 Data Ascii: XB#=LBuxtBtBxB9xBu5BHA5B@PQ5,A5(AUWs{=JXBuj5xBV5)%xB@xBtjPV)3EB28JXBtuLBBt;;~3=0Buuh\|Bh\|BVhB
Jan 30, 2021 12:51:07.017496109 CET	5516	IN	Data Raw: 00 21 00 00 85 c0 74 12 3b 44 24 10 7e 04 89 44 24 10 3b c7 0f 8f 4f 02 00 00 0f b7 05 fa 15 42 00 68 de 15 42 00 50 ff 35 98 15 42 00 e8 5b aa 00 00 0f b7 05 fc 15 42 00 6a 00 6a 00 50 e8 c1 20 00 00 85 c0 74 12 3b 44 24 10 7e 04 89 44 24 10 3b Data Ascii: !t;D$~D$;OBhBP5B[BjjP t;D$~D$;Bt&BtuSQ8\th@SOr$hj$PooS$(PpBBP$<$yB$B$
Jan 30, 2021 12:51:07.017537117 CET	5517	IN	Data Raw: 00 89 15 8c 15 42 00 e8 d5 16 00 00 99 a3 60 15 42 00 89 15 64 15 42 00 85 d2 7f 0e 0f 8c 52 ff ff ff 85 c0 0f 86 4a ff ff ff a1 54 15 42 00 03 c5 a3 58 15 42 00 8b c5 99 29 05 60 15 42 00 19 15 64 15 42 00 6a 04 bf 3c 09 41 00 57 e8 82 17 00 00 Data Ascii: B`BdBRJTBXB)`BdBj<AWjhBWlVKhPhB4{BY3YBD$9T$,uuc>D$0D$40D$0BD$4B<AHAp0ujWt
Jan 30, 2021 12:51:07.017575026 CET	5519	IN	Data Raw: 24 5c e8 e6 f3 ff ff e9 a8 00 00 00 c7 05 d4 96 42 00 01 00 00 00 a1 48 15 41 00 f6 40 28 01 74 6b e8 3f a4 00 00 33 f6 3b c6 74 62 83 f8 01 75 3f 39 35 e8 08 41 00 75 31 39 35 7c 26 42 00 74 09 56 e8 0d 71 00 00 59 eb 20 68 7c 22 42 00 e8 43 9b Data Ascii: $\BHA@(tk?3;tbu?95Au195\|&BtVqY h\|"BCPjs/cPhBvD$(D;D$~D$h\|"BPjs35LB;t;D$~D$=LBOD$8D$8;D$ xBj$$wxBh 5
Jan 30, 2021 12:51:07.017695904 CET	5520	IN	Data Raw: 80 79 10 00 75 10 80 79 12 00 74 05 e9 01 ff ff ff e9 77 fe ff ff c3 55 8b ec 51 53 56 8b f1 33 db 57 89 9e 18 0c 00 00 38 5e 16 74 04 c6 45 10 01 c7 45 fc 00 00 00 80 38 5d 14 74 07 c7 45 fc 00 00 00 c0 c7 45 14 01 00 00 00 38 5d 10 74 07 c7 45 Data Ascii: yuytwUQSV3W8^tEE8]tEE8]tE38^H%a:t E;tf9tSWjSuuP<@SWjSuuu@@uX@uE^^^8]tc~};tWbbDPWP
Jan 30, 2021 12:51:07.017745018 CET	5522	IN	Data Raw: 45 0c 2b c3 3b c7 72 02 8b c7 50 ff 75 08 8b ce e8 b4 fc ff ff 83 f8 ff 75 02 8b c7 01 45 fc 03 df 3b 5d 0c 72 c4 eb ab e8 66 35 00 00 85 c0 74 21 8b 44 24 08 85 c0 74 19 66 83 38 00 74 13 50 ff 15 48 e0 40 00 33 c9 83 f8 ff 0f 95 c1 8a c1 eb 1d Data Ascii: E+;rPuuE;]rf5t!D$tf8tPH@3\|$tt$@t3@3t$jVZ8O\D^\|$tD$t3@3D$jX4tD$tf8tPH@t$
Jan 30, 2021 12:51:07.017843962 CET	5523	IN	Data Raw: 5d fd 74 0c 8b 4d 14 8d 45 e8 50 e8 90 8e 00 00 38 5d ff 74 0c 8b 4d 18 8d 45 f0 50 e8 7f 8e 00 00 0f b6 45 fe f7 d8 1b c0 8d 4d e0 23 c1 50 0f b6 45 ff f7 d8 1b c0 8d 4d f0 23 c1 50 0f b6 45 fd f7 d8 1b c0 8d 4d e8 23 c1 50 56 ff 15 2c e1 40 00 Data Ascii: ]tMEP8]tMEPEM#PEM#PEM#PV,@VL@8]tuWuW^_[];jt$t$9h ZYt31BVWjPBWBVxBuWVWViB33@3_^dB`B

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49827	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:06.962435007 CET	5494	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:07.019006968 CET	5550	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: ef48ad975fb162c95a9705047e52376e Age: 38032 Date: Sat, 30 Jan 2021 11:51:07 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:07.019053936 CET	5551	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:07.019094944 CET	5553	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:07.019131899 CET	5554	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:07.019171000 CET	5555	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:07.019208908 CET	5557	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:07.019237995 CET	5557	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49834	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:10.962724924 CET	6089	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:11.016330004 CET	6196	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 846fe41890a0e38387aaf004661cc670 Age: 38036 Date: Sat, 30 Jan 2021 11:51:11 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:11.016381979 CET	6198	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:11.016429901 CET	6199	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:11.016472101 CET	6200	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:11.016509056 CET	6202	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:11.016546965 CET	6203	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:11.016577005 CET	6204	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49839	54.197.251.114	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:19.540098906 CET	7076	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 31 38 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039918,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:19.667771101 CET	7126	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:19 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49840	54.243.113.215	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:27.607261896 CET	7752	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 32 31 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039921,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:27.733886003 CET	7966	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:27 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49842	54.243.113.215	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:28.174545050 CET	8374	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 32 36 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039926,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:28.303565025 CET	8732	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:28 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49841	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:28.180525064 CET	8387	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:29.237943888 CET	9135	IN	HTTP/1.1 200 OK x-amz-id-2: Os2VD+pHsVp3rMT4BRwvClCrfXhGwKBknz4H5Ewi9crIc252nmIGv6/lfLi6SmB5Tz46LWwg8a8= x-amz-request-id: CDCBCC14C601DB68 Content-Type: application/json Server: AmazonS3 X-LLID: bd1b8a1a3dd5ccba6295966b56bbd9b7 Age: 38053 Date: Sat, 30 Jan 2021 11:51:28 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:29.331844091 CET	9137	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:29.331896067 CET	9138	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:29.385454893 CET	9140	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:29.385515928 CET	9141	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:29.385588884 CET	9142	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:29.438848019 CET	9143	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49843	54.197.251.114	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:33.059472084 CET	9145	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 32 37 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039927,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:33.189459085 CET	9145	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:33 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49844	54.197.251.114	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:35.643040895 CET	9502	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 33 32 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039932,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:35.774112940 CET	9508	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:35 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49736	107.22.221.32	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:43.215161085 CET	662	OUT	POST /e?i=29 HTTP/1.1 Host: i-29.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 171 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 38 31 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 66 6c 61 73 68 22 2c 20 22 66 6c 61 73 68 20 76 65 72 73 69 6f 6e 22 3a 20 22 31 38 2c 30 2c 30 2c 32 30 33 22 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039881,"eventName":"flash", "flash version": "18,0,0,203"}
Jan 30, 2021 12:50:43.344796896 CET	662	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:43 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49845	13.226.169.10	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:36.000294924 CET	9559	OUT	GET /images/mobile-icon.png HTTP/1.1 Host: utclient.utorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip If-Modified-Since: Sun, 1 Jan 1982 00:00:00 GMT Connection: Close
Jan 30, 2021 12:51:36.046161890 CET	9596	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1263 Connection: close Last-Modified: Tue, 11 Mar 2014 23:12:21 GMT x-amz-meta-cb-modifiedtime: Tue, 11 Mar 2014 23:12:00 GMT Accept-Ranges: bytes Server: AmazonS3 Date: Fri, 29 Jan 2021 20:55:42 GMT ETag: "4280089022fce23da2c64031bf137c08" X-Cache: Hit from cloudfront Via: 1.1 15735b6dcadf5dbe5de1549729298caa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MXP64-C3 X-Amz-Cf-Id: Csvo8oP7HbnppoJmQbFvKTRHQTrBx8ClMw-Qp-jfBjpDDTivuD8OtQ== Age: 53754
Jan 30, 2021 12:51:36.046222925 CET	9597	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 6b 69 54 58 74 58 4d 4c 3a Data Ascii: PNGIHDRatEXtSoftwareAdobe ImageReadyqe<kiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49846	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:36.026078939 CET	9559	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:36.079258919 CET	9598	IN	HTTP/1.1 200 OK x-amz-id-2: jwXezDPcH/gOHWUOETypqIFtLJZmMtwKexbupYZvn8E25c3JnCcgmJAlHtKTvO0GjZH0DxdDJu4= x-amz-request-id: 5FEE4E52F3232628 Content-Type: application/json Server: AmazonS3 X-LLID: 0e0e5551d526fdbae3d29e2cd336b260 Age: 38061 Date: Sat, 30 Jan 2021 11:51:36 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:36.079308033 CET	9600	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:36.079355955 CET	9601	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:36.079404116 CET	9603	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:36.079452038 CET	9604	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:36.079503059 CET	9605	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:36.079545021 CET	9606	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49847	54.197.251.114	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:36.177406073 CET	9746	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 33 34 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039934,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:36.306325912 CET	10039	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:36 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49848	13.226.169.4	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:36.192066908 CET	9746	OUT	GET /images/mobile-icon.png HTTP/1.1 Host: utclient.utorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip If-Modified-Since: Sun, 1 Jan 1982 00:00:00 GMT Connection: Close
Jan 30, 2021 12:51:36.239689112 CET	9871	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1263 Connection: close Last-Modified: Tue, 11 Mar 2014 23:12:21 GMT x-amz-meta-cb-modifiedtime: Tue, 11 Mar 2014 23:12:00 GMT Accept-Ranges: bytes Server: AmazonS3 Date: Fri, 29 Jan 2021 20:55:42 GMT ETag: "4280089022fce23da2c64031bf137c08" X-Cache: Hit from cloudfront Via: 1.1 5215c3c7bd4107002b4885309b3a1769.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MXP64-C3 X-Amz-Cf-Id: REraDjJjHZtxDde7qKsF2DupFMGk67L1r37_aW6Y-ulh9Q7gs9iuBg== Age: 53754
Jan 30, 2021 12:51:36.239991903 CET	9872	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 6b 69 54 58 74 58 4d 4c 3a Data Ascii: PNGIHDRatEXtSoftwareAdobe ImageReadyqe<kiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49849	54.243.113.215	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:36.692495108 CET	10573	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 33 35 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039935,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:36.825203896 CET	10789	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:36 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49850	13.226.169.41	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:39.899823904 CET	10790	OUT	GET /images/mobile-icon.png HTTP/1.1 Host: utclient.utorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip If-Modified-Since: Sun, 1 Jan 1982 00:00:00 GMT Connection: Close
Jan 30, 2021 12:51:39.944386005 CET	10791	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1263 Connection: close Last-Modified: Tue, 11 Mar 2014 23:12:21 GMT x-amz-meta-cb-modifiedtime: Tue, 11 Mar 2014 23:12:00 GMT Accept-Ranges: bytes Server: AmazonS3 Date: Fri, 29 Jan 2021 20:55:42 GMT ETag: "4280089022fce23da2c64031bf137c08" X-Cache: Hit from cloudfront Via: 1.1 b0fb64973ef509b9c9508897337515c3.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MXP64-C3 X-Amz-Cf-Id: 9K_0Wbg0wZ69gcZ-4Vl1A4ks-uykVX5djGHtc-NcISEMeOyMRsqQFw== Age: 53757
Jan 30, 2021 12:51:39.944442987 CET	10792	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 6b 69 54 58 74 58 4d 4c 3a Data Ascii: PNGIHDRatEXtSoftwareAdobe ImageReadyqe<kiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49852	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:39.948571920 CET	10792	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:40.004528999 CET	10856	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: fbf88473ef2b3dc77133e1c754049121 Age: 38064 Date: Sat, 30 Jan 2021 11:51:39 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:40.004614115 CET	10858	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:40.004666090 CET	10859	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:40.004715919 CET	10860	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:40.004765034 CET	10862	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:40.004817009 CET	10863	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:40.004859924 CET	10864	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49853	13.226.169.78	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:39.989830017 CET	10855	OUT	GET /images/mobile-icon.png HTTP/1.1 Host: utclient.utorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip If-Modified-Since: Sun, 1 Jan 1982 00:00:00 GMT Connection: Close
Jan 30, 2021 12:51:40.035451889 CET	10865	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1263 Connection: close Last-Modified: Tue, 11 Mar 2014 23:12:21 GMT x-amz-meta-cb-modifiedtime: Tue, 11 Mar 2014 23:12:00 GMT Accept-Ranges: bytes Server: AmazonS3 Date: Fri, 29 Jan 2021 20:55:42 GMT ETag: "4280089022fce23da2c64031bf137c08" X-Cache: Hit from cloudfront Via: 1.1 521484bc87dc7b3d509c41618270e818.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MXP64-C3 X-Amz-Cf-Id: eMWvEVIbi3xJ0r1fSTDoaBPpXZY2stj7gZepLOfV5sr0Mr6duh49GQ== Age: 53758
Jan 30, 2021 12:51:40.035788059 CET	10866	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 6b 69 54 58 74 58 4d 4c 3a Data Ascii: PNGIHDRatEXtSoftwareAdobe ImageReadyqe<kiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49851	54.243.113.215	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:40.020446062 CET	10865	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 33 35 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039935,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:40.149034977 CET	10867	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:40 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49854	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:40.169770956 CET	10868	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:40.225658894 CET	10869	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 0bd4f1374153c2f7397c0ce35fd0cdda Age: 38065 Date: Sat, 30 Jan 2021 11:51:40 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:40.225718975 CET	10871	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:40.225769997 CET	10872	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:40.225821018 CET	10873	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:40.225873947 CET	10875	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:40.225924015 CET	10876	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:40.225965023 CET	10877	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49737	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:43.549901009 CET	664	OUT	POST /e?i=21 HTTP/1.1 Host: i-21.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 397 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 38 32 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 73 69 6c 65 6e 74 5f 61 75 74 6f 75 70 64 61 74 65 22 2c 22 6c 61 75 6e 63 68 65 64 5f 74 61 72 67 65 74 22 3a 30 2c 22 75 70 64 61 74 65 64 22 3a 30 2c 22 72 65 6c 6f 63 61 74 65 64 22 3a 30 2c 22 76 65 72 73 69 6f 6e 73 22 3a 20 5b 7b 22 70 61 74 68 22 3a 22 75 70 64 61 74 65 73 5c 5c 33 2e 35 2e 35 5f 34 35 38 35 32 2e 65 78 65 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 31 31 31 39 31 35 38 30 34 22 2c 22 62 6c 61 63 6b 6c 69 73 74 65 64 22 3a 22 30 22 2c 22 63 72 61 73 68 5f 63 6f 75 6e 74 22 3a 22 30 22 2c 22 6f 70 74 5f 6f 75 74 22 3a 22 30 22 2c 22 72 75 6e 6e 69 6e 67 22 3a 22 22 7d 5d 2c 20 22 61 63 74 69 6f 6e 22 3a 22 49 6e 69 74 69 61 6c 20 64 6f 77 6e 6c 6f 61 64 22 2c 20 22 67 5f 76 65 72 73 69 6f 6e 22 3a 31 31 31 39 31 35 38 30 34 2c 20 22 6e 6f 5f 73 61 75 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039882,"eventName":"silent_autoupdate","launched_target":0,"updated":0,"relocated":0,"versions": [{"path":"updates\\3.5.5_45852.exe","version":"111915804","blacklisted":"0","crash_count":"0","opt_out":"0","running":""}], "action":"Initial download", "g_version":111915804, "no_sau":0}
Jan 30, 2021 12:50:43.677020073 CET	664	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:43 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	49855	54.243.113.215	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:40.343246937 CET	10878	OUT	POST /e?i=61 HTTP/1.1 Host: i-61.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 216 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 33 39 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 62 74 69 6e 73 74 61 6c 6c 73 22 2c 22 61 63 74 69 6f 6e 22 3a 22 64 6f 77 6e 6c 6f 61 64 22 2c 22 66 69 6c 65 6e 61 6d 65 22 3a 22 68 65 6c 70 65 72 5f 77 65 62 5f 75 69 2e 62 74 69 6e 73 74 61 6c 6c 22 2c 22 72 65 73 75 6c 74 22 3a 22 6f 6b 22 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039939,"eventName":"btinstalls","action":"download","filename":"helper_web_ui.btinstall","result":"ok"}
Jan 30, 2021 12:51:40.472384930 CET	10878	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:40 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.3	49856	54.197.251.114	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:40.670134068 CET	10879	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 33 39 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039939,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:40.798466921 CET	10880	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:40 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.3	49857	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:40.781650066 CET	10880	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:40.835448980 CET	10882	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: cc598cbbed625603672803d6163492e2 Age: 38065 Date: Sat, 30 Jan 2021 11:51:40 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:40.835500956 CET	10883	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:40.835550070 CET	10884	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:40.835598946 CET	10886	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:40.835647106 CET	10887	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:40.835695028 CET	10889	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:40.835737944 CET	10889	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.3	49858	54.197.251.114	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:41.741049051 CET	10890	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 33 39 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039939,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:41.868269920 CET	10891	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:41 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.3	49859	54.197.251.114	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:42.810580969 CET	10892	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 30 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039940,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:42.939124107 CET	10892	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:42 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.3	49860	23.21.217.194	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:43.157336950 CET	10893	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 31 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039941,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:43.284235001 CET	10894	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:43 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.3	49861	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:43.337826014 CET	10894	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:43.395587921 CET	10896	IN	HTTP/1.1 200 OK x-amz-id-2: Qkr8k/4NLa4N6GS3vczbMbnmL8Zlaz7sNzDKq1RJlAzZg5rNlrPGcoqz7znVlKY062I5zZKYCFg= x-amz-request-id: 3E4CA25ED8B4A12A Content-Type: application/json Server: AmazonS3 X-LLID: c4901be6bfefae1c39d09c485fbc6d43 Age: 38068 Date: Sat, 30 Jan 2021 11:51:43 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:43.395646095 CET	10897	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:43.395694971 CET	10899	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:43.395745039 CET	10900	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:43.395793915 CET	10902	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:43.395843983 CET	10903	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:43.395884991 CET	10904	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.3	49862	54.197.251.114	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:43.469965935 CET	10905	OUT	POST /e?i=64 HTTP/1.1 Host: i-64.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 236 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 32 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 68 65 6c 70 65 72 5f 73 75 70 70 6f 72 74 22 2c 22 61 63 74 69 6f 6e 22 3a 22 76 33 2e 34 35 38 35 32 2e 65 78 65 5f 6c 61 75 6e 63 68 2e 6f 6b 22 2c 22 68 76 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 66 69 6c 65 6e 61 6d 65 22 3a 22 68 65 6c 70 65 72 2e 65 78 65 22 2c 22 72 65 73 75 6c 74 22 3a 22 6f 6b 22 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039942,"eventName":"helper_support","action":"v3.45852.exe_launch.ok","hv":"unknown","filename":"helper.exe","result":"ok"}
Jan 30, 2021 12:51:43.599904060 CET	10905	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:43 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.3	49863	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:43.776940107 CET	10906	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:43.832015038 CET	10908	IN	HTTP/1.1 200 OK x-amz-id-2: DF6VZPmQv8NRzciJ7qXC4WWaASDwVCa3ctfP2bVGjCeNDgUqKBo/N8+ce/8cQ6I36TvjTuoiOc4= x-amz-request-id: F02B6D84C94B9989 Content-Type: application/json Server: AmazonS3 X-LLID: b258b6ffde68adc104c1bcf761d1de15 Age: 38068 Date: Sat, 30 Jan 2021 11:51:43 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:43.832072973 CET	10909	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:43.832144022 CET	10911	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:43.832206011 CET	10912	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:43.832262039 CET	10913	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:43.832319021 CET	10915	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:43.832374096 CET	10916	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.3	49864	23.21.217.194	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:43.801482916 CET	10906	OUT	POST /e?i=61 HTTP/1.1 Host: i-61.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 215 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 32 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 62 74 69 6e 73 74 61 6c 6c 73 22 2c 22 61 63 74 69 6f 6e 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 66 69 6c 65 6e 61 6d 65 22 3a 22 68 65 6c 70 65 72 5f 77 65 62 5f 75 69 2e 62 74 69 6e 73 74 61 6c 6c 22 2c 22 72 65 73 75 6c 74 22 3a 22 6f 6b 22 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039942,"eventName":"btinstalls","action":"install","filename":"helper_web_ui.btinstall","result":"ok"}
Jan 30, 2021 12:51:43.929306030 CET	10916	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:43 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49738	107.22.221.32	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:43.899668932 CET	665	OUT	POST /e?i=32 HTTP/1.1 Host: i-32.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 197 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 38 32 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 44 69 73 70 6c 61 79 43 61 72 64 22 2c 22 64 69 73 70 6c 61 79 5f 63 61 72 64 22 20 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 42 61 73 69 63 20 44 69 73 70 6c 61 79 20 41 64 61 70 74 65 72 22 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039882,"eventName":"DisplayCard","display_card" : "Microsoft Basic Display Adapter"}
Jan 30, 2021 12:50:44.028239012 CET	665	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:43 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.3	49865	23.21.217.194	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:44.151611090 CET	10917	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 32 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039942,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:44.280761957 CET	10918	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:44 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.3	49866	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:44.264354944 CET	10918	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:44.321634054 CET	10920	IN	HTTP/1.1 200 OK x-amz-id-2: jQe8EJoxnGC44GUzry2MsFqM8uQPo7N1leiXK8Ob7cKELZtZPkpgEBDxWRVIPtsF5aM7TwDfxk8= x-amz-request-id: 5E8DD6565DE56017 Content-Type: application/json Server: AmazonS3 X-LLID: 821223e37dcd342429c50ee53782bf10 Age: 38069 Date: Sat, 30 Jan 2021 11:51:44 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:44.321691036 CET	10921	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:44.321743011 CET	10922	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:44.321794987 CET	10924	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:44.321845055 CET	10925	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:44.321893930 CET	10926	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:44.321935892 CET	10927	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.3	49867	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:44.474318981 CET	10928	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 33 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039943,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:44.601054907 CET	10929	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:44 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.3	49868	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:44.670340061 CET	10930	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:44.722590923 CET	10931	IN	HTTP/1.1 200 OK x-amz-id-2: /u1iTkPtQ+sWCcloUV0NgKhY4yA5RzW/2ApZNNkNl5B+1XC+WsA29KZDCOvqgcD0kEHX+M3E1Sw= x-amz-request-id: 8F28C82C1AA12B94 Content-Type: application/json Server: AmazonS3 X-LLID: 4c75ae48a54d526f4af6fa9c35edfe8e Age: 38069 Date: Sat, 30 Jan 2021 11:51:44 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:44.722650051 CET	10932	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:44.722712040 CET	10934	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:44.722773075 CET	10935	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:44.722831011 CET	10937	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:44.722929955 CET	10938	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:44.722984076 CET	10939	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.3	49869	23.21.217.194	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:44.862632036 CET	10939	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 33 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039943,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:44.989989996 CET	10940	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:44 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.3	49870	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:45.135552883 CET	10941	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:45.189162016 CET	10943	IN	HTTP/1.1 200 OK x-amz-id-2: Os2VD+pHsVp3rMT4BRwvClCrfXhGwKBknz4H5Ewi9crIc252nmIGv6/lfLi6SmB5Tz46LWwg8a8= x-amz-request-id: CDCBCC14C601DB68 Content-Type: application/json Server: AmazonS3 X-LLID: 187a0cfca65048d9525257f03b6ffb42 Age: 38070 Date: Sat, 30 Jan 2021 11:51:45 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:45.189224958 CET	10944	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:45.189286947 CET	10945	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:45.189346075 CET	10947	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:45.189425945 CET	10948	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:45.189485073 CET	10950	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:45.189538002 CET	10950	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.3	49871	23.21.217.194	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:45.185307980 CET	10941	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 33 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039943,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:45.312268972 CET	10951	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:45 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.3	49872	23.21.217.194	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:45.553040981 CET	10952	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 34 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039944,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:45.681231976 CET	10953	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:45 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.3	49873	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:45.664127111 CET	10952	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:45.718909025 CET	10954	IN	HTTP/1.1 200 OK x-amz-id-2: CY2dGSnttRm2bBt1hhVn3QFHY0E31vUuBexbGl0L1xfj9S8kl6e3XzONjs5fharJwAYMzIUV5Qc= x-amz-request-id: 02B31F74AD6E5687 Content-Type: application/json Server: AmazonS3 X-LLID: 4551b75f9b79bafdbf09e207a4ee11fd Age: 38070 Date: Sat, 30 Jan 2021 11:51:45 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:45.718971968 CET	10956	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:45.719033003 CET	10957	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:45.719093084 CET	10958	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:45.719153881 CET	10960	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:45.719213963 CET	10961	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:45.719268084 CET	10962	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.3	49874	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:45.878544092 CET	10963	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 34 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039944,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:46.007989883 CET	10963	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:45 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49739	54.243.113.215	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:44.424690962 CET	667	OUT	POST /e?i=49 HTTP/1.1 Host: i-49.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 170 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 38 32 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 66 69 72 73 74 5f 72 75 6e 22 2c 22 61 63 74 69 6f 6e 22 3a 22 73 75 63 63 65 73 73 22 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039882,"eventName":"client_first_run","action":"success"}
Jan 30, 2021 12:50:44.552037001 CET	667	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:44 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.3	49875	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:46.158823013 CET	10964	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:46.217331886 CET	10966	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 19233581d1b0608ba2b654fc4646a71c Age: 38071 Date: Sat, 30 Jan 2021 11:51:46 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:46.217418909 CET	10967	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:46.217475891 CET	10969	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:46.217525005 CET	10970	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:46.217569113 CET	10971	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:46.217622042 CET	10973	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:46.217664003 CET	10973	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.3	49876	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:46.233355045 CET	10974	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 34 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039944,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:46.362183094 CET	10974	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:46 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.3	49877	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:46.624315977 CET	10976	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 35 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039945,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:46.750834942 CET	10976	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:46 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.3	49878	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:46.736280918 CET	10976	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:46.792881012 CET	10978	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: cf9bd85743a5aa3047a6127cd5ee55c0 Age: 38071 Date: Sat, 30 Jan 2021 11:51:46 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:46.792938948 CET	10979	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:46.792990923 CET	10981	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:46.793040037 CET	10982	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:46.793088913 CET	10983	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:46.793137074 CET	10985	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:46.793179035 CET	10985	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.3	49879	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:47.021215916 CET	10986	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:47.074846983 CET	10988	IN	HTTP/1.1 200 OK x-amz-id-2: lhxD38bNXtJ5bQTIbEdMzRBnak+sm+nn2A2b8Ke7o53bhup+BRYZfu4E48Z9v/889+tUr0+YAy8= x-amz-request-id: 770EAECEAC544072 Content-Type: application/json Server: AmazonS3 X-LLID: 55f252e32a53ffa3993c1d5c26dd8805 Age: 38072 Date: Sat, 30 Jan 2021 11:51:47 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:47.074901104 CET	10990	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:47.074951887 CET	10991	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:47.075002909 CET	10992	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:47.075051069 CET	10994	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:47.075099945 CET	10995	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:47.075141907 CET	10996	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.3	49880	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:47.064966917 CET	10987	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 35 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039945,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:47.192367077 CET	10996	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:47 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.3	49881	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:47.429080009 CET	10998	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 36 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039946,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:47.558549881 CET	11007	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:47 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.3	49882	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:47.430138111 CET	10998	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:47.485826015 CET	10999	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 06c44a8bccd4ed4a1167ba35dbf874ff Age: 38072 Date: Sat, 30 Jan 2021 11:51:47 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:47.485882998 CET	11001	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:47.485932112 CET	11002	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:47.485981941 CET	11003	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:47.486078978 CET	11005	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:47.486162901 CET	11006	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:47.486198902 CET	11007	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.3	49883	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:47.766499043 CET	11008	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:47.819037914 CET	11010	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: 2603e58294b5c1467ae02ee6844fd70f Age: 38072 Date: Sat, 30 Jan 2021 11:51:47 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:47.819099903 CET	11011	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:47.819159985 CET	11013	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:47.819217920 CET	11014	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:47.819273949 CET	11015	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:47.819334030 CET	11017	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:47.819387913 CET	11017	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.3	49884	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:47.846868992 CET	11018	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 36 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039946,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:47.976212025 CET	11018	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:47 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49740	54.197.251.114	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:50:54.800342083 CET	676	OUT	POST /e?i=20 HTTP/1.1 Host: i-20.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 419 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 38 39 33 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 48 61 6e 67 50 72 6f 62 6c 65 6d 22 2c 22 68 74 22 3a 31 30 30 39 34 2c 22 75 74 22 3a 39 37 2c 22 67 73 22 3a 22 34 44 30 30 32 30 2c 35 42 46 45 30 41 2c 35 42 46 44 36 43 2c 35 43 36 34 31 38 2c 35 43 31 44 41 44 2c 35 43 35 45 38 32 2c 35 43 44 32 38 34 2c 35 44 41 45 42 31 2c 35 44 41 45 44 43 2c 35 39 39 36 35 44 2c 35 39 38 46 38 32 2c 34 34 32 32 32 42 22 2c 22 6e 73 22 3a 22 34 45 44 38 39 32 2c 34 36 37 43 31 46 2c 34 36 37 43 31 46 2c 34 36 37 43 33 38 2c 34 36 37 42 42 35 2c 34 45 44 38 39 32 2c 34 39 33 30 45 44 2c 34 32 34 39 39 30 2c 34 37 37 37 35 30 2c 34 37 34 31 37 45 2c 34 45 44 38 33 34 2c 34 45 44 38 39 32 2c 34 45 44 38 39 32 2c 34 45 44 38 33 34 2c 34 37 34 34 37 30 2c 34 36 38 34 35 41 2c 34 36 38 33 46 34 2c 34 36 38 33 46 34 2c 34 36 38 33 46 34 22 2c 22 6f 73 22 3a 22 31 30 2e 30 2e 31 37 31 33 34 2e 31 2e 30 2e 22 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039893,"eventName":"HangProblem","ht":10094,"ut":97,"gs":"4D0020,5BFE0A,5BFD6C,5C6418,5C1DAD,5C5E82,5CD284,5DAEB1,5DAEDC,59965D,598F82,44222B","ns":"4ED892,467C1F,467C1F,467C38,467BB5,4ED892,4930ED,424990,477750,47417E,4ED834,4ED892,4ED892,4ED834,474470,46845A,4683F4,4683F4,4683F4","os":"10.0.17134.1.0."}
Jan 30, 2021 12:50:54.927063942 CET	676	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:50:54 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.3	49885	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:48.195033073 CET	11020	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 36 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039946,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:48.325010061 CET	11029	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:48 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.3	49886	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:48.230185032 CET	11020	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:48.285676956 CET	11021	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: b17615294156b843db3e3ac1e4f4bcad Age: 38073 Date: Sat, 30 Jan 2021 11:51:48 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:48.285737991 CET	11023	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:48.285799026 CET	11024	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:48.285857916 CET	11025	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:48.285917044 CET	11027	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:48.285978079 CET	11028	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:48.286030054 CET	11029	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.3	49887	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:48.574223042 CET	11030	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 37 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039947,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:48.702688932 CET	11031	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:48 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.3	49888	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:48.707160950 CET	11031	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:48.760113955 CET	11033	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: ec3810e6f0a63282dddd3cb511b47fa9 Age: 38073 Date: Sat, 30 Jan 2021 11:51:48 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:48.760169029 CET	11034	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:48.760219097 CET	11035	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:48.760267019 CET	11037	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:48.760317087 CET	11038	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:48.760365963 CET	11039	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:48.760409117 CET	11040	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.3	49889	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:48.924388885 CET	11041	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 37 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039947,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:49.051207066 CET	11042	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:48 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.3	49890	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:49.061243057 CET	11042	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:49.116645098 CET	11044	IN	HTTP/1.1 200 OK x-amz-id-2: TNUNP6yeAPuOZA1bgCrHzFuBcWls1Z7VaLz5Yo7Acn20TsckMLPMGz+L6gicMKirPvi5bXait0k= x-amz-request-id: 0C9C0238236DA54D Content-Type: application/json Server: AmazonS3 X-LLID: 51cba075f40d30ffc8aa0c1e2bb70ef6 Age: 38074 Date: Sat, 30 Jan 2021 11:51:49 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:49.116700888 CET	11045	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:49.116753101 CET	11047	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:49.116801023 CET	11048	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:49.116849899 CET	11050	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:49.116900921 CET	11051	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:49.116936922 CET	11052	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.3	49891	50.17.220.153	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:49.240112066 CET	11052	OUT	POST /e?i=43 HTTP/1.1 Host: i-43.b-45852.ut.bench.utorrent.com User-Agent: ut_core BenchHttp (ver:45852) Connection: close Content-Length: 167 Data Raw: 7b 22 68 22 3a 22 67 47 6e 4e 51 34 4d 6d 4f 4d 39 4c 74 45 70 55 22 2c 22 63 6c 22 3a 22 75 54 6f 72 72 65 6e 74 22 2c 22 76 22 3a 31 31 31 39 31 35 38 30 34 2c 22 72 65 76 22 3a 34 35 38 35 32 2c 22 6c 22 3a 22 65 6e 22 2c 22 63 63 22 3a 32 39 30 2c 22 70 76 22 3a 22 22 2c 22 77 22 3a 22 31 30 2e 30 22 2c 22 63 74 73 22 3a 31 36 31 32 30 33 39 39 34 38 2c 22 65 76 65 6e 74 4e 61 6d 65 22 3a 22 63 6c 69 65 6e 74 5f 75 73 61 67 65 22 2c 22 74 72 69 67 67 65 72 22 3a 30 2c 22 34 34 32 22 3a 30 7d Data Ascii: {"h":"gGnNQ4MmOM9LtEpU","cl":"uTorrent","v":111915804,"rev":45852,"l":"en","cc":290,"pv":"","w":"10.0","cts":1612039948,"eventName":"client_usage","trigger":0,"442":0}
Jan 30, 2021 12:51:49.366621971 CET	11053	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Sat, 30 Jan 2021 11:51:49 GMT Server: nginx X-Powered-By: PHP/5.4.30 Content-Length: 21 Connection: Close Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 7d Data Ascii: {"response_code":200}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.3	49892	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:49.350763083 CET	11053	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:49.403357983 CET	11055	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: cd86beb01386c87b3b1acb0eb4fc5d3e Age: 38074 Date: Sat, 30 Jan 2021 11:51:49 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:49.403414011 CET	11056	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:49.403464079 CET	11057	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:49.403511047 CET	11059	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:49.403563023 CET	11060	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:49.403601885 CET	11062	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:49.403654099 CET	11062	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.3	49893	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:49.856929064 CET	11063	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:49.911371946 CET	11065	IN	HTTP/1.1 200 OK x-amz-id-2: pmv0cVQLjIfjOKPKw0moNsqcIuxMHtOaM+kk8ZfBJqa0VqW580W4CuGxin79uTISQa+nLHzyyhE= x-amz-request-id: 4CAD6EC9788A884A Content-Type: application/json Server: AmazonS3 X-LLID: 24a3d8c971f7cc9edab7f90f861a6b39 Age: 38074 Date: Sat, 30 Jan 2021 11:51:49 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:49.911432028 CET	11066	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:49.911499023 CET	11067	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:49.911569118 CET	11069	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:49.911623955 CET	11070	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:49.911695957 CET	11071	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:49.911741018 CET	11072	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.3	49894	178.79.242.147	80	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe

Timestamp	kBytes transferred	Direction	Data
Jan 30, 2021 12:51:50.102895021 CET	11073	OUT	GET /control/tags/ut.json HTTP/1.1 Host: cdn.ap.bittorrent.com User-Agent: BTWebClient/355S(45852) Accept-Encoding: gzip Accept-Language: en-US Connection: Close
Jan 30, 2021 12:51:50.157301903 CET	11074	IN	HTTP/1.1 200 OK x-amz-id-2: JgFqm7Q/7Tb2vji8j16eTgQkh/ch8pJn92JC/oWtWJapfRPSi8kqSO+KWsu7IdZbBUFqFazXzKw= x-amz-request-id: C0D1C16F5BFE2F38 Content-Type: application/json Server: AmazonS3 X-LLID: e14279cc0dd1bfed9a123327a0e4f05d Age: 38075 Date: Sat, 30 Jan 2021 11:51:50 GMT Last-Modified: Thu, 28 Jan 2021 18:56:58 GMT Expires: Sun, 31 Jan 2021 01:17:15 GMT Content-Length: 8153 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=86400 Data Raw: 7b 0d 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 33 39 38 2c 0d 0a 20 20 22 61 64 72 75 6c 65 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 64 65 66 61 75 6c 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 6f 6e 74 61 63 74 52 61 74 65 22 3a 20 36 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 33 30 2c 0d 0a 20 20 20 20 20 20 22 72 65 73 65 74 41 64 73 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 73 65 6e 64 43 6f 6e 76 65 72 73 69 6f 6e 22 3a 20 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 32 30 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 32 30 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 31 32 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 72 75 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 72 65 66 72 65 73 68 5f 31 35 22 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 66 74 52 65 66 72 65 73 68 52 61 74 65 22 3a 20 31 35 2c 0d 0a 20 20 20 20 20 20 22 61 64 52 65 66 72 65 73 68 52 61 74 65 50 61 74 74 65 72 6e 22 3a 5b 39 30 30 5d 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 30 30 2c 0d 0a 20 20 20 20 20 20 22 65 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 66 74 45 6e 61 62 6c 65 64 22 3a 20 Data Ascii: { "version": 398, "adrules": [ { "name": "default", "contactRate": 60, "adRefreshRate": 30, "lrecRefreshRate": 30, "ftRefreshRate": 30, "resetAds": 0, "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "sendConversion": 0, "lrecXButton":0 }, { "name": "refresh_20", "adRefreshRate": 20, "lrecRefreshRate": 20, "ftRefreshRate": 20, "adRefreshRatePattern":[1200], "rollout": 100, "enabled": 1, "ftEnabled": 1, "lrecEnabled": 1, "countries": "ru" }, { "name": "refresh_15", "adRefreshRate": 15, "lrecRefreshRate": 15, "ftRefreshRate": 15, "adRefreshRatePattern":[900], "rollout": 100, "enabled": 1, "ftEnabled":
Jan 30, 2021 12:51:50.157361031 CET	11076	IN	Data Raw: 31 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 45 6e 61 62 6c 65 64 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 69 65 73 22 3a 20 22 61 72 2c 61 74 2c 62 65 2c 62 72 2c 64 6b 2c 69 6e 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b Data Ascii: 1, "lrecEnabled": 1, "countries": "ar,at,be,br,dk,in" }, { "name": "refresh_10", "adRefreshRate": 10, "lrecRefreshRate": 10, "ftRefreshRate": 10, "adRefreshRatePattern":[600], "
Jan 30, 2021 12:51:50.157443047 CET	11077	IN	Data Raw: 20 22 6c 72 65 63 58 42 75 74 74 6f 6e 22 3a 30 2c 0d 0a 20 20 20 20 20 20 22 6d 61 78 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 31 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 62 75 6e 6e 64 Data Ascii: "lrecXButton":0, "maxFeatureLevel": 1 }, { "name": "bunndle_off", "enabled": 0, "campaignCodes":[600,601] }, { "name": "refresh_legacy", "adRefreshRate": 30, "lrecRefreshRat
Jan 30, 2021 12:51:50.157496929 CET	11078	IN	Data Raw: 22 75 73 22 2c 0d 0a 20 20 20 20 20 20 22 72 6f 6c 6c 6f 75 74 22 3a 20 31 39 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 31 37 2d 31 34 25 3d 33 25 20 74 6f 20 74 65 73 74 22 2c 0d 0a 20 20 20 Data Ascii: "us", "rollout": 19 }, { "name": "17-14%=3% to test", "adurl": "https://test.trontv.com/network/utclassic.html?bucket=test-bt-co", "countries": "us", "rollout": 17 }, { "name": "14-
Jan 30, 2021 12:51:50.157546997 CET	11080	IN	Data Raw: 61 6d 65 22 3a 20 22 61 64 6f 70 73 20 37 32 38 78 39 30 20 74 65 73 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 66 74 61 64 74 79 70 65 73 22 3a 20 5b 20 34 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c Data Ascii: ame": "adops 728x90 test bucket 3", "ftadtypes": [ 4 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-728x90-3", "campaignCodes": [ 316 ], "rollout": 100
Jan 30, 2021 12:51:50.157598019 CET	11081	IN	Data Raw: 74 20 62 75 63 6b 65 74 20 33 22 2c 0d 0a 20 20 20 20 20 20 22 6c 72 65 63 61 64 74 79 70 65 73 22 3a 20 5b 20 35 20 5d 2c 0d 0a 20 20 20 20 20 20 22 6d 69 6e 46 65 61 74 75 72 65 4c 65 76 65 6c 22 3a 20 33 2c 0d 0a 20 20 20 20 20 20 22 61 64 75 Data Ascii: t bucket 3", "lrecadtypes": [ 5 ], "minFeatureLevel": 3, "adurl": "https://video.trontv.com/network/utclassic.html?bucket=adops-test-mrec-3", "campaignCodes": [ 320 ], "rollout": 100 }, { "na
Jan 30, 2021 12:51:50.157640934 CET	11082	IN	Data Raw: 74 70 73 3a 2f 2f 73 74 61 67 69 6e 67 2e 74 72 6f 6e 74 76 2e 63 6f 6d 2f 6e 65 74 77 6f 72 6b 2f 75 74 63 6c 61 73 73 69 63 2e 68 74 6d 6c 3f 62 75 63 6b 65 74 3d 73 6d 61 72 74 22 2c 0d 0a 20 20 20 20 20 20 22 63 61 6d 70 61 69 67 6e 43 6f 64 Data Ascii: tps://staging.trontv.com/network/utclassic.html?bucket=smart", "campaignCodes": [ 313 ], "rollout": 100 }, { "name": "staging utclassic smart bucket", "adurl": "https://staging.trontv.com/network/utclassic

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: yVn2ywuhEC.exe PID: 2168 Parent PID: 5644

General

Start time:	12:48:15
Start date:	30/01/2021
Path:	C:\Users\user\Desktop\yVn2ywuhEC.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\yVn2ywuhEC.exe' -install
Imagebase:	0x140000000
File size:	32864256 bytes
MD5 hash:	FA9649BA7F76190701B2F1FFAAF4D0DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_vovalex, Description: Yara detected VovaLex Ransomware, Source: 00000000.00000000.239895376.0000000140087000.00000008.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 3yYh0IvfZPkSsqrl.exe PID: 6128 Parent PID: 2168

General

Start time:	12:48:28
Start date:	30/01/2021
Path:	C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe
Imagebase:	0x400000
File size:	32067320 bytes
MD5 hash:	70ED5E8A31519EC2FD1131020FE8421B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 6%, Metadefender, Browse Detection: 10%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: yVn2ywuhEC.exe PID: 5340 Parent PID: 5644

General

Start time:	12:48:29
Start date:	30/01/2021
Path:	C:\Users\user\Desktop\yVn2ywuhEC.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\yVn2ywuhEC.exe' /install
Imagebase:	0x140000000
File size:	32864256 bytes
MD5 hash:	FA9649BA7F76190701B2F1FFAAF4D0DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_vovalex, Description: Yara detected VovaLex Ransomware, Source: 00000002.00000000.269817660.0000000140087000.00000008.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 3yYh0IvfZPkSsqrl.tmp PID: 3008 Parent PID: 6128

General

Start time:	12:48:29
Start date:	30/01/2021
Path:	C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\is-CMJUV.tmp\3yYh0IvfZPkSsqrl.tmp' /SL5='$B0076,31402076,326656,C:\Users\user\AppData\Local\Temp\3yYh0IvfZPkSsqrl.exe'
Imagebase:	0x400000
File size:	1392128 bytes
MD5 hash:	3A7636D874B391801839C0BEE90BED21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 6%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: 0i1CtyGdkmLhJnVs.exe PID: 5452 Parent PID: 5340

General

Start time:	12:48:42
Start date:	30/01/2021
Path:	C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe
Imagebase:	0x400000
File size:	32067320 bytes
MD5 hash:	70ED5E8A31519EC2FD1131020FE8421B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 6%, Metadefender, Browse Detection: 10%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: yVn2ywuhEC.exe PID: 996 Parent PID: 5644

General

Start time:	12:48:43
Start date:	30/01/2021
Path:	C:\Users\user\Desktop\yVn2ywuhEC.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\yVn2ywuhEC.exe' /load
Imagebase:	0x140000000
File size:	32864256 bytes
MD5 hash:	FA9649BA7F76190701B2F1FFAAF4D0DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_vovalex, Description: Yara detected VovaLex Ransomware, Source: 00000008.00000000.304380149.0000000140087000.00000008.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 0i1CtyGdkmLhJnVs.tmp PID: 2160 Parent PID: 5452

General

Start time:	12:48:49
Start date:	30/01/2021
Path:	C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\is-CR0N3.tmp\0i1CtyGdkmLhJnVs.tmp' /SL5='$60238,31402076,326656,C:\Users\user\AppData\Local\Temp\0i1CtyGdkmLhJnVs.exe'
Imagebase:	0x400000
File size:	1392128 bytes
MD5 hash:	3A7636D874B391801839C0BEE90BED21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 6%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: PHO27fVEZKCoh9MD.exe PID: 4724 Parent PID: 996

General

Start time:	12:49:24
Start date:	30/01/2021
Path:	C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe
Imagebase:	0x400000
File size:	32067320 bytes
MD5 hash:	70ED5E8A31519EC2FD1131020FE8421B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 6%, Metadefender, Browse Detection: 10%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: netsh.exe PID: 3292 Parent PID: 3008

General

Start time:	12:49:26
Start date:	30/01/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public
Imagebase:	0x1320000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 3820 Parent PID: 3292

General

Start time:	12:49:26
Start date:	30/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: netsh.exe PID: 5132 Parent PID: 3008

General

Start time:	12:49:28
Start date:	30/01/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public
Imagebase:	0x1320000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5204 Parent PID: 5132

General

Start time:	12:49:28
Start date:	30/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: netsh.exe PID: 5700 Parent PID: 3008

General

Start time:	12:49:30
Start date:	30/01/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent (TCP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow
Imagebase:	0x1320000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5572 Parent PID: 5700

General

Start time:	12:49:30
Start date:	30/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: netsh.exe PID: 5056 Parent PID: 3008

General

Start time:	12:49:34
Start date:	30/01/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent (UDP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow
Imagebase:	0xd80000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5956 Parent PID: 5056

General

Start time:	12:49:37
Start date:	30/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: PHO27fVEZKCoh9MD.tmp PID: 4784 Parent PID: 4724

General

Start time:	12:49:39
Start date:	30/01/2021
Path:	C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\is-BP9EM.tmp\PHO27fVEZKCoh9MD.tmp' /SL5='$303F2,31402076,326656,C:\Users\user\AppData\Local\Temp\PHO27fVEZKCoh9MD.exe'
Imagebase:	0x400000
File size:	1392128 bytes
MD5 hash:	3A7636D874B391801839C0BEE90BED21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi

Chronological Activities

Analysis Process: netsh.exe PID: 5088 Parent PID: 2160

General

Start time:	12:49:47
Start date:	30/01/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public
Imagebase:	0x1320000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5580 Parent PID: 5088

General

Start time:	12:49:48
Start date:	30/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: uTorrent.exe PID: 5932 Parent PID: 3008

General

Start time:	12:49:51
Start date:	30/01/2021
Path:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
Imagebase:	0x400000
File size:	2146776 bytes
MD5 hash:	4939D280485BDC0AC67B49012BDCEC08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: netsh.exe PID: 4080 Parent PID: 2160

General

Start time:	12:49:50
Start date:	30/01/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent' dir=in action=allow program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' enable=yes profile=public
Imagebase:	0x1320000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 1260 Parent PID: 4080

General

Start time:	12:49:51
Start date:	30/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: netsh.exe PID: 5708 Parent PID: 2160

General

Start time:	12:49:57
Start date:	30/01/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=TCP name='uTorrent (TCP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow
Imagebase:	0x7ff6883e0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5984 Parent PID: 5708

General

Start time:	12:49:58
Start date:	30/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: netsh.exe PID: 4916 Parent PID: 2160

General

Start time:	12:50:01
Start date:	30/01/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\netsh.exe' advfirewall firewall add rule protocol=UDP name='uTorrent (UDP-In)' program='C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe' dir=in action=allow
Imagebase:	0x1320000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5772 Parent PID: 4916

General

Start time:	12:50:01
Start date:	30/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: unins000.exe PID: 5236 Parent PID: 4784

General

Start time:	12:50:02
Start date:	30/01/2021
Path:	C:\Users\user\AppData\Roaming\uTorrent\unins000.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\uTorrent\unins000.exe
Imagebase:	0x400000
File size:	1415027 bytes
MD5 hash:	D2E364571A8BC684C4B11FD499CD023D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 3yYh0IvfZPkSsqrl.exe PID: 6128 Parent PID: 2168 3yYh0IvfZPkSsqrl.exeCOMMON

Executed Functions

Function 004110C4, Relevance: 43.9, APIs: 7, Strings: 18, Instructions: 165
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E004110C4(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				long _t39;
				_Unknown_base(*)()* _t42;
				_Unknown_base(*)()* _t43;
				_Unknown_base(*)()* _t46;
				signed int _t51;
				void* _t111;
				void* _t112;
				intOrPtr _t129;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t135;
				signed int _t136;
				signed int _t137;
				signed int _t138;
				signed int _t139;
				signed int _t140;
				signed int _t141;
				signed int _t142;
				signed int _t143;
				signed int _t144;
				signed int _t145;
				struct HINSTANCE__* _t148;
				intOrPtr* _t150;
				intOrPtr _t152;
				intOrPtr _t153;

				_t152 = _t153;
				_t112 = 7;
				do {
					_push(0);
					_push(0);
					_t112 = _t112 - 1;
				} while (_t112 != 0);
				_push(_t152);
				_push(0x411338);
				_push( *[fs:eax]);
				 *[fs:eax] = _t153;
				 *0x415b58 =  *0x415b58 - 1;
				if( *0x415b58 >= 0) {
					L19:
					_pop(_t129);
					 *[fs:eax] = _t129;
					_push(E0041133F);
					return L00404C90( &_v60, 0xe);
				}
				_t148 = GetModuleHandleW(L"kernel32.dll");
				_t39 = GetVersion();
				_t111 = 0;
				if(_t39 != 0x600) {
					_t150 = GetProcAddress(_t148, "SetDefaultDllDirectories");
					if(_t150 != 0) {
						 *_t150(0x800);
						asm("sbb ebx, ebx");
						_t111 = 1;
					}
				}
				if(_t111 == 0) {
					_t46 = GetProcAddress(_t148, "SetDllDirectoryW");
					if(_t46 != 0) {
						 *_t46(0x411394);
					}
					E0040699C( &_v8);
					E00404C98(0x415b5c, _v8);
					if( *0x415b5c != 0) {
						_t51 =  *0x415b5c; // 0x0
						if(_t51 != 0) {
							_t51 =  *(_t51 - 4);
						}
						_t132 =  *0x415b5c; // 0x0
						if( *((short*)(_t132 + _t51 * 2 - 2)) != 0x5c) {
							E00404F98(0x415b5c, 0x4113a4);
						}
						_t133 =  *0x415b5c; // 0x0
						E00405058( &_v12, L"uxtheme.dll", _t133);
						E004069C8(_v12, _t111);
						_t134 =  *0x415b5c; // 0x0
						E00405058( &_v16, L"userenv.dll", _t134);
						E004069C8(_v16, _t111);
						_t135 =  *0x415b5c; // 0x0
						E00405058( &_v20, L"setupapi.dll", _t135);
						E004069C8(_v20, _t111);
						_t136 =  *0x415b5c; // 0x0
						E00405058( &_v24, L"apphelp.dll", _t136);
						E004069C8(_v24, _t111);
						_t137 =  *0x415b5c; // 0x0
						E00405058( &_v28, L"propsys.dll", _t137);
						E004069C8(_v28, _t111);
						_t138 =  *0x415b5c; // 0x0
						E00405058( &_v32, L"dwmapi.dll", _t138);
						E004069C8(_v32, _t111);
						_t139 =  *0x415b5c; // 0x0
						E00405058( &_v36, L"cryptbase.dll", _t139);
						E004069C8(_v36, _t111);
						_t140 =  *0x415b5c; // 0x0
						E00405058( &_v40, L"oleacc.dll", _t140);
						E004069C8(_v40, _t111);
						_t141 =  *0x415b5c; // 0x0
						E00405058( &_v44, L"version.dll", _t141);
						E004069C8(_v44, _t111);
						_t142 =  *0x415b5c; // 0x0
						E00405058( &_v48, L"profapi.dll", _t142);
						E004069C8(_v48, _t111);
						_t143 =  *0x415b5c; // 0x0
						E00405058( &_v52, L"comres.dll", _t143);
						E004069C8(_v52, _t111);
						_t144 =  *0x415b5c; // 0x0
						E00405058( &_v56, L"clbcatq.dll", _t144);
						E004069C8(_v56, _t111);
						_t145 =  *0x415b5c; // 0x0
						E00405058( &_v60, L"ntmarta.dll", _t145);
						E004069C8(_v60, _t111);
					}
				}
				_t42 = GetProcAddress(_t148, "SetSearchPathMode");
				if(_t42 != 0) {
					 *_t42(0x8001);
				}
				_t43 = GetProcAddress(_t148, "SetProcessDEPPolicy");
				if(_t43 != 0) {
					 *_t43(1); // executed
				}
				goto L19;
			}

0x004110c5
0x004110c7
0x004110cc
0x004110cc
0x004110ce
0x004110d0
0x004110d0
0x004110d8
0x004110d9
0x004110de
0x004110e1
0x004110e4
0x004110eb
0x0041131d
0x0041131f
0x00411322
0x00411325
0x00411337
0x00411337
0x004110fb
0x004110fd
0x00411104
0x0041110a
0x00411117
0x0041111b
0x00411122
0x00411127
0x00411129
0x00411129
0x0041111b
0x0041112c
0x00411138
0x0041113f
0x00411146
0x00411146
0x0041114b
0x00411158
0x00411164
0x0041116a
0x00411171
0x00411176
0x00411176
0x00411178
0x00411184
0x00411190
0x00411190
0x0041119d
0x004111a3
0x004111ab
0x004111b8
0x004111be
0x004111c6
0x004111d3
0x004111d9
0x004111e1
0x004111ee
0x004111f4
0x004111fc
0x00411209
0x0041120f
0x00411217
0x00411224
0x0041122a
0x00411232
0x0041123f
0x00411245
0x0041124d
0x0041125a
0x00411260
0x00411268
0x00411275
0x0041127b
0x00411283
0x00411290
0x00411296
0x0041129e
0x004112ab
0x004112b1
0x004112b9
0x004112c6
0x004112cc
0x004112d4
0x004112e1
0x004112e7
0x004112ef
0x004112ef
0x00411164
0x004112fa
0x00411301
0x00411308
0x00411308
0x00411310
0x00411317
0x0041131b
0x0041131b
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,00411338,?,?,?,?,00000000,00000000), ref: 004110F6
GetVersion.KERNEL32(kernel32.dll,00000000,00411338,?,?,?,?,00000000,00000000), ref: 004110FD
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00411112
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00411138

Part of subcall function 004069C8: SetErrorMode.KERNEL32(00008000), ref: 004069D6
Part of subcall function 004069C8: LoadLibraryW.KERNEL32(00000000,00000000,00406A20,?,00000000,00406A3E,?,00008000), ref: 00406A05

GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004112FA
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 00411310
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,00000000,00411338,?,?,?,?,00000000,00000000), ref: 0041131B

Strings

kernel32.dll, xrefs: 004110F1
SetDefaultDllDirectories, xrefs: 0041110C
setupapi.dll, xrefs: 004111CE
oleacc.dll, xrefs: 00411255
cryptbase.dll, xrefs: 0041123A
apphelp.dll, xrefs: 004111E9
propsys.dll, xrefs: 00411204
SetProcessDEPPolicy, xrefs: 0041130A
uxtheme.dll, xrefs: 00411198
clbcatq.dll, xrefs: 004112C1
profapi.dll, xrefs: 0041128B
version.dll, xrefs: 00411270
comres.dll, xrefs: 004112A6
SetSearchPathMode, xrefs: 004112F4
dwmapi.dll, xrefs: 0041121F
userenv.dll, xrefs: 004111B3
ntmarta.dll, xrefs: 004112DC
SetDllDirectoryW, xrefs: 00411132

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorHandleLibraryLoadModeModulePolicyProcessVersion
String ID: SetDefaultDllDirectories$SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$apphelp.dll$clbcatq.dll$comres.dll$cryptbase.dll$dwmapi.dll$kernel32.dll$ntmarta.dll$oleacc.dll$profapi.dll$propsys.dll$setupapi.dll$userenv.dll$uxtheme.dll$version.dll
API String ID: 2248137261-1119018034
Opcode ID: 3cf6f028df5ac572b7a74e3bd327a38eddc7003f3b7d32fa40efc486d46733a3
Instruction ID: c6a35a4e19e82500e6cf24896e164367356d9424bfa06cb54d8f17a5f6ff4412
Opcode Fuzzy Hash: 3cf6f028df5ac572b7a74e3bd327a38eddc7003f3b7d32fa40efc486d46733a3
Instruction Fuzzy Hash: DB518E706105089BD704FB65D8429DE77B6EF85308F60C13BEA11B76E5CB38AD458B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE8, Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 207
registrystringlibraryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00405DE8(WCHAR* __eax) {
				WCHAR* _v8;
				void* _v12;
				short _v18;
				short _v22;
				short _v32;
				int _v36;
				short _v558;
				long _t48;
				signed int _t58;
				long _t67;
				long _t69;
				long _t71;
				WCHAR* _t82;
				struct HINSTANCE__* _t89;
				struct HINSTANCE__* _t96;
				short* _t108;
				WCHAR* _t109;
				intOrPtr _t113;
				signed int _t115;
				signed int _t116;
				signed int _t118;
				signed int _t119;
				signed int _t121;
				signed int _t122;
				struct HINSTANCE__* _t124;
				void* _t127;
				void* _t129;
				intOrPtr _t130;
				long _t137;

				_t127 = _t129;
				_t130 = _t129 + 0xfffffdd4;
				_v8 = __eax;
				GetModuleFileNameW(0,  &_v558, 0x105);
				_v32 = 0;
				_t48 = RegOpenKeyExW(0x80000001, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v12); // executed
				if(_t48 == 0) {
					L4:
					_push(_t127);
					_push(0x405f1c);
					_push( *[fs:eax]);
					 *[fs:eax] = _t130;
					_v36 = 0xa;
					E00405BEC( &_v558, 0x105);
					if(RegQueryValueExW(_v12,  &_v558, 0, 0,  &_v32,  &_v36) != 0) {
						_t137 = RegQueryValueExW(_v12, E00406110, 0, 0,  &_v32,  &_v36);
						if(_t137 != 0) {
							_v32 = 0;
						}
					}
					_t58 = _v36 >> 1;
					if(_t137 < 0) {
						asm("adc eax, 0x0");
					}
					 *((short*)(_t127 + _t58 * 2 - 0x1c)) = 0;
					_pop(_t113);
					 *[fs:eax] = _t113;
					_push(E00405F23);
					return RegCloseKey(_v12);
				} else {
					_t67 = RegOpenKeyExW(0x80000002, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v12); // executed
					if(_t67 == 0) {
						goto L4;
					} else {
						_t69 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Locales", 0, 0xf0019,  &_v12); // executed
						if(_t69 == 0) {
							goto L4;
						} else {
							_t71 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Delphi\\Locales", 0, 0xf0019,  &_v12); // executed
							if(_t71 != 0) {
								lstrcpynW( &_v558, _v8, 0x105);
								GetLocaleInfoW(GetThreadLocale(), 3,  &_v22, 5); // executed
								_t124 = 0;
								if(_v558 != 0 && (_v22 != 0 || _v32 != 0)) {
									_t108 = lstrlenW( &_v558) + _t80 +  &_v558;
									L16:
									if( *_t108 != 0x2e && _t108 !=  &_v558) {
										_t108 = _t108 - 2;
										goto L16;
									}
									_t82 =  &_v558;
									if(_t108 != _t82) {
										_t109 = _t108 + 2;
										if(_v32 != 0) {
											_t121 = _t109 - _t82;
											_t122 = _t121 >> 1;
											if(_t121 < 0) {
												asm("adc edx, 0x0");
											}
											lstrcpynW(_t109,  &_v32, 0x105 - _t122);
											_t124 = LoadLibraryExW( &_v558, 0, 2);
										}
										if(_t124 == 0 && _v22 != 0) {
											_t115 = _t109 -  &_v558;
											_t116 = _t115 >> 1;
											if(_t115 < 0) {
												asm("adc edx, 0x0");
											}
											lstrcpynW(_t109,  &_v22, 0x105 - _t116);
											_t89 = LoadLibraryExW( &_v558, 0, 2); // executed
											_t124 = _t89;
											if(_t124 == 0) {
												_v18 = 0;
												_t118 = _t109 -  &_v558;
												_t119 = _t118 >> 1;
												if(_t118 < 0) {
													asm("adc edx, 0x0");
												}
												lstrcpynW(_t109,  &_v22, 0x105 - _t119);
												_t96 = LoadLibraryExW( &_v558, 0, 2); // executed
												_t124 = _t96;
											}
										}
									}
								}
								return _t124;
							} else {
								goto L4;
							}
						}
					}
				}
			}

0x00405de9
0x00405deb
0x00405df3
0x00405e04
0x00405e09
0x00405e24
0x00405e2b
0x00405e8b
0x00405e8d
0x00405e8e
0x00405e93
0x00405e96
0x00405e99
0x00405eab
0x00405ece
0x00405eea
0x00405eec
0x00405eee
0x00405eee
0x00405eec
0x00405ef7
0x00405ef9
0x00405efb
0x00405efb
0x00405efe
0x00405f07
0x00405f0a
0x00405f0d
0x00405f1b
0x00405e2d
0x00405e42
0x00405e49
0x00000000
0x00405e4b
0x00405e60
0x00405e67
0x00000000
0x00405e69
0x00405e7e
0x00405e85
0x00405f33
0x00405f46
0x00405f4b
0x00405f55
0x00405f83
0x00405f8a
0x00405f8e
0x00405f87
0x00000000
0x00405f87
0x00405f9a
0x00405fa2
0x00405fa8
0x00405fb0
0x00405fb4
0x00405fb6
0x00405fb8
0x00405fba
0x00405fba
0x00405fca
0x00405fdf
0x00405fdf
0x00405fe3
0x00405ff4
0x00405ff6
0x00405ff8
0x00405ffa
0x00405ffa
0x0040600a
0x0040601a
0x0040601f
0x00406023
0x00406025
0x00406033
0x00406035
0x00406037
0x00406039
0x00406039
0x00406049
0x00406059
0x0040605e
0x0040605e
0x00406023
0x00405fe3
0x00405fa2
0x00406067
0x00000000
0x00000000
0x00000000
0x00405e85
0x00405e67
0x00405e49

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,?,00000000), ref: 00405E04
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,?,00000000), ref: 00405E24
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,?,00000000), ref: 00405E42
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000), ref: 00405E60
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00405E7E
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00405F1C,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?), ref: 00405EC7
RegQueryValueExW.ADVAPI32(?,00406110,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00405F1C,?,80000001), ref: 00405EE5
RegCloseKey.ADVAPI32(?,00405F23,00000000,?,?,00000000,00405F1C,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00405F16
lstrcpynW.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000), ref: 00405F33
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 00405F40
GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019), ref: 00405F46
lstrlenW.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00405F74
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00405FCA
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00405FDA
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 0040600A
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 0040601A
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 00406049

Strings

Software\Borland\Delphi\Locales, xrefs: 00405E74
Software\Borland\Locales, xrefs: 00405E56
Software\CodeGear\Locales, xrefs: 00405E1A, 00405E38

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Openlstrcpyn$LibraryLoadLocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales
API String ID: 3838733197-345420546
Opcode ID: ed19aa05aec1765680b8a5727bfaec113ff10cf714bcfc3f630a7a3f4138bf86
Instruction ID: 5f6b4038d93197cc4a444e8185523a96e657e7a92dffb1bb2a9d05fafe77d5e4
Opcode Fuzzy Hash: ed19aa05aec1765680b8a5727bfaec113ff10cf714bcfc3f630a7a3f4138bf86
Instruction Fuzzy Hash: 30615671A406197AEB21DAA5CC46FEF72BCDB0C744F404076BA01FA5C1E6BC9E448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405F23, Relevance: 15.1, APIs: 10, Instructions: 108
stringlibrarythreadCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00405F23() {
				void* _t32;
				struct HINSTANCE__* _t39;
				struct HINSTANCE__* _t46;
				short* _t57;
				WCHAR* _t58;
				signed int _t60;
				signed int _t61;
				signed int _t63;
				signed int _t64;
				signed int _t66;
				signed int _t67;
				struct HINSTANCE__* _t68;
				void* _t70;

				lstrcpynW(_t70 - 0x22a,  *(_t70 - 4), 0x105);
				GetLocaleInfoW(GetThreadLocale(), 3, _t70 - 0x12, 5); // executed
				_t68 = 0;
				if( *(_t70 - 0x22a) == 0 ||  *(_t70 - 0x12) == 0 &&  *(_t70 - 0x1c) == 0) {
					L20:
					return _t68;
				} else {
					_t57 = lstrlenW(_t70 - 0x22a) + _t30 + _t70 - 0x22a;
					L5:
					if( *_t57 != 0x2e && _t57 != _t70 - 0x22a) {
						_t57 = _t57 - 2;
						goto L5;
					}
					_t32 = _t70 - 0x22a;
					if(_t57 != _t32) {
						_t58 = _t57 + 2;
						if( *(_t70 - 0x1c) != 0) {
							_t66 = _t58 - _t32;
							_t67 = _t66 >> 1;
							if(_t66 < 0) {
								asm("adc edx, 0x0");
							}
							lstrcpynW(_t58, _t70 - 0x1c, 0x105 - _t67);
							_t68 = LoadLibraryExW(_t70 - 0x22a, 0, 2);
						}
						if(_t68 == 0 &&  *(_t70 - 0x12) != 0) {
							_t60 = _t58 - _t70 - 0x22a;
							_t61 = _t60 >> 1;
							if(_t60 < 0) {
								asm("adc edx, 0x0");
							}
							lstrcpynW(_t58, _t70 - 0x12, 0x105 - _t61);
							_t39 = LoadLibraryExW(_t70 - 0x22a, 0, 2); // executed
							_t68 = _t39;
							if(_t68 == 0) {
								 *((short*)(_t70 - 0xe)) = 0;
								_t63 = _t58 - _t70 - 0x22a;
								_t64 = _t63 >> 1;
								if(_t63 < 0) {
									asm("adc edx, 0x0");
								}
								lstrcpynW(_t58, _t70 - 0x12, 0x105 - _t64);
								_t46 = LoadLibraryExW(_t70 - 0x22a, 0, 2); // executed
								_t68 = _t46;
							}
						}
					}
					goto L20;
				}
			}

0x00405f33
0x00405f46
0x00405f4b
0x00405f55
0x00406060
0x00406067
0x00405f6d
0x00405f83
0x00405f8a
0x00405f8e
0x00405f87
0x00000000
0x00405f87
0x00405f9a
0x00405fa2
0x00405fa8
0x00405fb0
0x00405fb4
0x00405fb6
0x00405fb8
0x00405fba
0x00405fba
0x00405fca
0x00405fdf
0x00405fdf
0x00405fe3
0x00405ff4
0x00405ff6
0x00405ff8
0x00405ffa
0x00405ffa
0x0040600a
0x0040601a
0x0040601f
0x00406023
0x00406025
0x00406033
0x00406035
0x00406037
0x00406039
0x00406039
0x00406049
0x00406059
0x0040605e
0x0040605e
0x00406023
0x00405fe3
0x00000000
0x00405fa2

APIs

lstrcpynW.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000), ref: 00405F33
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 00405F40
GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019), ref: 00405F46
lstrlenW.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00405F74
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00405FCA
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00405FDA
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 0040600A
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 0040601A
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 00406049
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?), ref: 00406059

Strings

Software\Borland\Delphi\Locales, xrefs: 00405E74
Software\Borland\Locales, xrefs: 00405E56
Software\CodeGear\Locales, xrefs: 00405E1A, 00405E38

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales
API String ID: 1599918012-345420546
Opcode ID: f347cc9f3c477e58c1cd365ffa1779204afb21583e55c99ec7d7252987469007
Instruction ID: 4452d95ce859696c23b6bd0f50a078a4c31ee5800544849d8d1c420259f7e676
Opcode Fuzzy Hash: f347cc9f3c477e58c1cd365ffa1779204afb21583e55c99ec7d7252987469007
Instruction Fuzzy Hash: D3318232E402196BDB21DAA5CC49BEB62BC9B0C344F444076B601F72C4F6BC9E448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00406458, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406458() {
				intOrPtr _v16;
				struct _SYSTEM_INFO* _t3;

				GetSystemInfo(_t3); // executed
				return _v16;
			}

0x0040645c
0x00406468

APIs

GetSystemInfo.KERNEL32 ref: 0040645C

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 9ce24fec29c07a0e080f9dc895799ad5acc0e028318248ff73c69df84a526f2f
Instruction ID: 0cc09a7703e4d468e824d7ecf1c2981a2773579081892800ab72b071deb089ba
Opcode Fuzzy Hash: 9ce24fec29c07a0e080f9dc895799ad5acc0e028318248ff73c69df84a526f2f
Instruction Fuzzy Hash: C4A012204084010AC508A7194C8380F31841945614FC80324745CB93D2E619856403DB

Uniqueness

Uniqueness Score: -1.00%

Function 00411CDA, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00411CDA(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t21;
				intOrPtr _t23;
				struct HWND__* _t25;
				struct HWND__* _t26;
				struct HWND__* _t29;
				intOrPtr _t30;
				intOrPtr _t32;
				intOrPtr _t40;
				intOrPtr _t43;
				int _t44;
				intOrPtr _t45;
				intOrPtr _t47;
				struct HWND__* _t50;
				intOrPtr _t51;
				intOrPtr _t54;
				void* _t57;
				intOrPtr _t63;
				intOrPtr _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t76;
				void* _t77;

				_t77 = __eflags;
				_t57 = __ecx;
				SetLastError( *(__eax + 0x18));
				E0040E788(0x69, __ebx, _t57, __esi, _t77);
				E0040404C();
				_t21 =  *0x41865c; // 0x0
				 *0x41865c = 0;
				E00403894(_t21);
				_t23 =  *0x415b48; // 0x400000
				_t25 = E004068EC(0, L"STATIC", 0, _t23, 0, 0, 0, 0, 0, 0, 0); // executed
				 *0x412af4 = _t25;
				_t26 =  *0x412af4; // 0xb0076
				 *0x418654 = SetWindowLongW(_t26, 0xfffffffc, E0040EADC);
				_t29 =  *0x412af4; // 0xb0076
				 *(_t76 - 0x58) = _t29;
				 *((char*)(_t76 - 0x54)) = 0;
				_t30 =  *0x418664; // 0x45872c
				_t5 = _t30 + 0x20; // 0x1df285c
				 *((intOrPtr*)(_t76 - 0x50)) =  *_t5;
				 *((char*)(_t76 - 0x4c)) = 0;
				_t32 =  *0x418664; // 0x45872c
				_t8 = _t32 + 0x24; // 0x4fc00
				 *((intOrPtr*)(_t76 - 0x48)) =  *_t8;
				 *((char*)(_t76 - 0x44)) = 0;
				E004082D4(L"/SL5=\"$%x,%d,%d,", 2, _t76 - 0x58, _t76 - 0x40);
				_push( *((intOrPtr*)(_t76 - 0x40)));
				_push( *0x418658);
				_push(0x411f9c);
				E0040B84C(_t76 - 0x5c, __ebx, __esi, _t77);
				_push( *((intOrPtr*)(_t76 - 0x5c)));
				E0040513C(_t76 - 0x3c, 4, __edi);
				_t40 =  *0x418670; // 0x0, executed
				E0040EB68(_t40, __ebx, 0x412af0,  *((intOrPtr*)(_t76 - 0x3c)), __edi, __esi, __fp0); // executed
				if( *0x412aec != 0xffffffff) {
					_t54 =  *0x412aec; // 0x0
					E0040EA44(_t54, 0x412af0);
				}
				_pop(_t71);
				 *[fs:eax] = _t71;
				_push(0x411e70);
				_t43 =  *0x41865c; // 0x0
				_t44 = E00403894(_t43);
				if( *0x418670 != 0) {
					_t73 =  *0x418670; // 0x0
					_t44 = E0040E5F4(0, _t73, 0xfa, 0x32); // executed
				}
				if( *0x418668 != 0) {
					_t51 =  *0x418668; // 0x0
					_t44 = RemoveDirectoryW(E00404D24(_t51)); // executed
				}
				if( *0x412af4 != 0) {
					_t50 =  *0x412af4; // 0xb0076
					_t44 = DestroyWindow(_t50); // executed
				}
				if( *0x41864c != 0) {
					_t45 =  *0x41864c; // 0x0
					_t63 =  *0x418650; // 0x1f
					_t72 =  *0x40dcdc; // 0x40dce0
					E00405548(_t45, _t63, _t72);
					_t47 =  *0x41864c; // 0x0
					E00402E20(_t47);
					 *0x41864c = 0;
					return 0;
				}
				return _t44;
			}

0x00411cda
0x00411cda
0x00411cde
0x00411ce5
0x00411cea
0x00411cef
0x00411cf6
0x00411cfc
0x00411d0f
0x00411d23
0x00411d28
0x00411d34
0x00411d3f
0x00411d48
0x00411d4d
0x00411d50
0x00411d54
0x00411d59
0x00411d5c
0x00411d5f
0x00411d63
0x00411d68
0x00411d6b
0x00411d6e
0x00411d7f
0x00411d84
0x00411d87
0x00411d8d
0x00411d95
0x00411d9a
0x00411da5
0x00411db2
0x00411db7
0x00411dc3
0x00411dc5
0x00411dca
0x00411dca
0x00411dd1
0x00411dd4
0x00411dd7
0x00411ddc
0x00411de1
0x00411ded
0x00411dfb
0x00411e03
0x00411e03
0x00411e0f
0x00411e11
0x00411e1c
0x00411e1c
0x00411e28
0x00411e2a
0x00411e30
0x00411e30
0x00411e3c
0x00411e3e
0x00411e43
0x00411e49
0x00411e4f
0x00411e54
0x00411e59
0x00411e60
0x00000000
0x00411e60
0x00411e65

APIs

SetLastError.KERNEL32(?), ref: 00411CDE

Part of subcall function 0040E788: GetLastError.KERNEL32(00000000,0040E82F,?,?,00000000), ref: 0040E7AB

Part of subcall function 004068EC: CreateWindowExW.USER32 ref: 0040692B

SetWindowLongW.USER32 ref: 00411D3A

Part of subcall function 0040B84C: GetCommandLineW.KERNEL32(00000000,0040B88E,?,?,00000000,?,00411D9A,00411F9C,?), ref: 0040B862

Part of subcall function 0040EB68: CreateProcessW.KERNEL32 ref: 0040EBD8
Part of subcall function 0040EB68: CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,0040EC68,00000000,0040EC58,00000000), ref: 0040EBEC
Part of subcall function 0040EB68: MsgWaitForMultipleObjects.USER32 ref: 0040EC05
Part of subcall function 0040EB68: GetExitCodeProcess.KERNEL32 ref: 0040EC19
Part of subcall function 0040EB68: CloseHandle.KERNEL32(?,?,00412AF0,00000001,?,00000000,000000FF,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040EC22

RemoveDirectoryW.KERNEL32(00000000,00411E70,?,?,?,?,?,?,?,?,?,?,000B0076,000000FC,0040EADC,00000000), ref: 00411E1C
DestroyWindow.USER32(000B0076,00411E70,?,?,?,?,?,?,?,?,?,?,000B0076,000000FC,0040EADC,00000000), ref: 00411E30

Strings

InnoSetupLdrWindow, xrefs: 00411D17
/SL5="$%x,%d,%d,, xrefs: 00411D7A
STATIC, xrefs: 00411D1C

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CloseCreateErrorHandleLastProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 2016261911-3001827809
Opcode ID: fbdef65544812fc2fc5f55329c28774d8983140436ef1dc00e8779e1b3522691
Instruction ID: 54a9d7d8dc4727101b4181681a56b9dc25b3924365ca5ccb1b1aebfc1eaa2fcc
Opcode Fuzzy Hash: fbdef65544812fc2fc5f55329c28774d8983140436ef1dc00e8779e1b3522691
Instruction Fuzzy Hash: 68411771A002449FD714EBA9ED45BDA77E5EB48308F10C53AE600AB2E5CB789852CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401C7C, Relevance: 12.2, APIs: 8, Instructions: 221
sleepCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00401C7C(void* __eax, signed int __edi, void* __ebp) {
				struct _MEMORY_BASIC_INFORMATION _v44;
				void* _v48;
				signed int __ebx;
				void* _t58;
				signed int _t61;
				int _t65;
				signed int _t67;
				void _t70;
				int _t71;
				signed int _t78;
				void* _t79;
				signed int _t81;
				intOrPtr _t82;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				signed int _t92;
				void* _t96;
				signed int _t99;
				void* _t103;
				intOrPtr _t104;
				void* _t106;
				void* _t108;
				signed int _t113;
				void* _t115;
				void* _t116;

				_t56 = __eax;
				_t89 =  *(__eax - 4);
				_t78 =  *0x41304d; // 0x0
				if((_t89 & 0x00000007) != 0) {
					__eflags = _t89 & 0x00000005;
					if((_t89 & 0x00000005) != 0) {
						_pop(_t78);
						__eflags = _t89 & 0x00000003;
						if((_t89 & 0x00000003) == 0) {
							_push(_t78);
							_push(__edi);
							_t116 = _t115 + 0xffffffdc;
							_t103 = __eax - 0x10;
							E0040165C();
							_t58 = _t103;
							 *_t116 =  *_t58;
							_v48 =  *((intOrPtr*)(_t58 + 4));
							_t92 =  *(_t58 + 0xc);
							if((_t92 & 0x00000008) != 0) {
								_t79 = _t103;
								_t113 = _t92 & 0xfffffff0;
								_t99 = 0;
								__eflags = 0;
								while(1) {
									VirtualQuery(_t79,  &_v44, 0x1c);
									_t61 = VirtualFree(_t79, 0, 0x8000);
									__eflags = _t61;
									if(_t61 == 0) {
										_t99 = _t99 | 0xffffffff;
										goto L10;
									}
									_t104 = _v44.RegionSize;
									__eflags = _t113 - _t104;
									if(_t113 > _t104) {
										_t113 = _t113 - _t104;
										_t79 = _t79 + _t104;
										continue;
									}
									goto L10;
								}
							} else {
								_t65 = VirtualFree(_t103, 0, 0x8000); // executed
								if(_t65 == 0) {
									_t99 = __edi | 0xffffffff;
								} else {
									_t99 = 0;
								}
							}
							L10:
							if(_t99 == 0) {
								 *_v48 =  *_t116;
								 *( *_t116 + 4) = _v48;
							}
							 *0x415ac4 = 0;
							return _t99;
						} else {
							return 0xffffffff;
						}
					} else {
						goto L31;
					}
				} else {
					__eflags = __bl;
					__ebx =  *__edx;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L14;
							}
							asm("pause");
							__eflags =  *0x4138d5;
							if(__eflags != 0) {
								continue;
							} else {
								Sleep(0);
								__edx = __edx;
								__ecx = __ecx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__eflags != 0) {
									Sleep(0xa);
									__edx = __edx;
									__ecx = __ecx;
									continue;
								}
							}
							goto L14;
						}
					}
					L14:
					_t14 = __edx + 0xc;
					 *_t14 =  *(__edx + 0xc) - 1;
					__eflags =  *_t14;
					__eax =  *(__edx + 8);
					if( *_t14 == 0) {
						__eflags = __eax;
						if(__eax == 0) {
							L20:
							 *(__ebx + 0xc) = __eax;
						} else {
							__eax =  *(__edx + 0x14);
							__ecx =  *(__edx + 4);
							 *(__eax + 4) = __ecx;
							 *(__ecx + 0x14) = __eax;
							__eax = 0;
							__eflags =  *((intOrPtr*)(__ebx + 0x10)) - __edx;
							if( *((intOrPtr*)(__ebx + 0x10)) == __edx) {
								goto L20;
							}
						}
						 *__ebx = __al;
						__eax = __edx;
						__edx =  *(__edx - 4);
						__bl =  *0x41304d; // 0x0
						L31:
						__eflags = _t78;
						_t81 = _t89 & 0xfffffff0;
						_push(_t101);
						_t106 = _t56;
						if(__eflags != 0) {
							while(1) {
								_t67 = 0x100;
								asm("lock cmpxchg [0x413a34], ah");
								if(__eflags == 0) {
									goto L32;
								}
								asm("pause");
								__eflags =  *0x4138d5;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									_t67 = 0x100;
									asm("lock cmpxchg [0x413a34], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L32;
							}
						}
						L32:
						__eflags = (_t106 - 4)[_t81] & 0x00000001;
						_t87 = (_t106 - 4)[_t81];
						if(((_t106 - 4)[_t81] & 0x00000001) != 0) {
							_t67 = _t81 + _t106;
							_t88 = _t87 & 0xfffffff0;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E004014D8(_t67);
							}
						} else {
							_t88 = _t87 | 0x00000008;
							__eflags = _t88;
							(_t106 - 4)[_t81] = _t88;
						}
						__eflags =  *(_t106 - 4) & 0x00000008;
						if(( *(_t106 - 4) & 0x00000008) != 0) {
							_t88 =  *(_t106 - 8);
							_t106 = _t106 - _t88;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E004014D8(_t106);
							}
						}
						__eflags = _t81 - 0x13ffe0;
						if(_t81 == 0x13ffe0) {
							__eflags =  *0x413a3c - 0x13ffe0;
							if( *0x413a3c != 0x13ffe0) {
								_t82 = _t106 + 0x13ffe0;
								E00401578(_t67);
								 *((intOrPtr*)(_t82 - 4)) = 2;
								 *0x413a3c = 0x13ffe0;
								 *0x413a38 = _t82;
								 *0x413a34 = 0;
								__eflags = 0;
								return 0;
							} else {
								_t108 = _t106 - 0x10;
								_t70 =  *_t108;
								_t96 =  *(_t108 + 4);
								 *(_t70 + 4) = _t96;
								 *_t96 = _t70;
								 *0x413a34 = 0;
								_t71 = VirtualFree(_t108, 0, 0x8000);
								__eflags = _t71 - 1;
								asm("sbb eax, eax");
								return _t71;
							}
						} else {
							 *(_t106 - 4) = _t81 + 3;
							 *(_t106 - 8 + _t81) = _t81;
							E00401518(_t106, _t88, _t81);
							 *0x413a34 = 0;
							__eflags = 0;
							return 0;
						}
					} else {
						__eflags = __eax;
						 *(__edx + 8) = __ecx;
						 *(__ecx - 4) = __eax;
						if(__eflags == 0) {
							__ecx =  *(__ebx + 4);
							 *(__edx + 0x14) = __ebx;
							 *(__edx + 4) = __ecx;
							 *(__ecx + 0x14) = __edx;
							 *(__ebx + 4) = __edx;
							 *__ebx = 0;
							__eax = 0;
							__eflags = 0;
							_pop(__ebx);
							return 0;
						} else {
							__eax = 0;
							__eflags = 0;
							 *__ebx = __al;
							_pop(__ebx);
							return 0;
						}
					}
				}
			}

0x00401c7c
0x00401c7c
0x00401c85
0x00401c8b
0x00401d74
0x00401d77
0x00401e64
0x00401e65
0x00401e68
0x00401708
0x0040170a
0x0040170c
0x00401711
0x00401714
0x00401719
0x0040171d
0x00401723
0x00401727
0x0040172d
0x00401749
0x0040174d
0x00401750
0x00401750
0x00401752
0x0040175a
0x00401767
0x0040176c
0x0040176e
0x00401770
0x00401773
0x00401773
0x00401775
0x00401779
0x0040177b
0x0040177d
0x0040177f
0x00000000
0x0040177f
0x00000000
0x0040177b
0x0040172f
0x00401737
0x0040173e
0x00401744
0x00401740
0x00401740
0x00401740
0x0040173e
0x00401783
0x00401785
0x0040178e
0x00401797
0x00401797
0x0040179a
0x004017aa
0x00401e6e
0x00401e73
0x00401e73
0x00000000
0x00000000
0x00000000
0x00401c91
0x00401c91
0x00401c93
0x00401c95
0x00401cf8
0x00401cf8
0x00401cfd
0x00401d01
0x00000000
0x00000000
0x00401d03
0x00401d05
0x00401d0c
0x00000000
0x00401d0e
0x00401d12
0x00401d17
0x00401d18
0x00401d19
0x00401d1e
0x00401d22
0x00401d2c
0x00401d31
0x00401d32
0x00000000
0x00401d32
0x00401d22
0x00000000
0x00401d0c
0x00401cf8
0x00401c97
0x00401c97
0x00401c97
0x00401c97
0x00401c9b
0x00401c9e
0x00401ccc
0x00401cce
0x00401ce3
0x00401ce3
0x00401cd0
0x00401cd0
0x00401cd3
0x00401cd6
0x00401cd9
0x00401cdc
0x00401cde
0x00401ce1
0x00000000
0x00000000
0x00401ce1
0x00401ce6
0x00401ce8
0x00401cea
0x00401ced
0x00401d7d
0x00401d80
0x00401d82
0x00401d84
0x00401d85
0x00401d87
0x00401d38
0x00401d38
0x00401d3d
0x00401d45
0x00000000
0x00000000
0x00401d47
0x00401d49
0x00401d50
0x00000000
0x00401d52
0x00401d54
0x00401d59
0x00401d5e
0x00401d66
0x00401d6a
0x00000000
0x00401d6a
0x00401d66
0x00000000
0x00401d50
0x00401d38
0x00401d89
0x00401d89
0x00401d91
0x00401d95
0x00401dcc
0x00401dcf
0x00401dd2
0x00401dd4
0x00401dda
0x00401ddc
0x00401ddc
0x00401d97
0x00401d97
0x00401d97
0x00401d9a
0x00401d9a
0x00401d9e
0x00401da2
0x00401de4
0x00401de7
0x00401de9
0x00401deb
0x00401df1
0x00401df5
0x00401df5
0x00401df1
0x00401da4
0x00401daa
0x00401dfc
0x00401e06
0x00401e34
0x00401e3a
0x00401e3f
0x00401e46
0x00401e50
0x00401e56
0x00401e5d
0x00401e61
0x00401e08
0x00401e08
0x00401e0b
0x00401e0d
0x00401e10
0x00401e13
0x00401e15
0x00401e24
0x00401e29
0x00401e2c
0x00401e30
0x00401e30
0x00401dac
0x00401daf
0x00401db2
0x00401dba
0x00401dbf
0x00401dc6
0x00401dca
0x00401dca
0x00401ca0
0x00401ca0
0x00401ca2
0x00401ca8
0x00401cab
0x00401cb4
0x00401cb7
0x00401cba
0x00401cbd
0x00401cc0
0x00401cc3
0x00401cc6
0x00401cc6
0x00401cc8
0x00401cc9
0x00401cad
0x00401cad
0x00401cad
0x00401caf
0x00401cb1
0x00401cb2
0x00401cb2
0x00401cab
0x00401c9e

APIs

Sleep.KERNEL32(00000000,?,?,00000000,004018EE), ref: 00401D12
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,004018EE), ref: 00401D2C

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: ecfed8f1ed0807f6ccd603253e02b2531eae0721a97c3b398313b2851d848f78
Instruction ID: 467b249c574562f1bac75438b18abd5afc4c200c530fec1930f0d5df439eec02
Opcode Fuzzy Hash: ecfed8f1ed0807f6ccd603253e02b2531eae0721a97c3b398313b2851d848f78
Instruction Fuzzy Hash: 9B71E1316452408BE715DF29CA84B66BBD4AF85314F18827FE848AB3F2D778D8418799

Uniqueness

Uniqueness Score: -1.00%

Function 00411CBF, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00411CBF(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t17;
				intOrPtr _t19;
				struct HWND__* _t21;
				struct HWND__* _t22;
				struct HWND__* _t25;
				intOrPtr _t26;
				intOrPtr _t28;
				intOrPtr _t36;
				intOrPtr _t39;
				int _t40;
				intOrPtr _t41;
				intOrPtr _t43;
				struct HWND__* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				intOrPtr _t60;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				void* _t73;
				void* _t74;

				_t74 = __eflags;
				_pop(_t62);
				 *[fs:eax] = _t62;
				_t17 =  *0x41865c; // 0x0
				 *0x41865c = 0;
				E00403894(_t17);
				_t19 =  *0x415b48; // 0x400000
				_t21 = E004068EC(0, L"STATIC", 0, _t19, 0, 0, 0, 0, 0, 0, 0); // executed
				 *0x412af4 = _t21;
				_t22 =  *0x412af4; // 0xb0076
				 *0x418654 = SetWindowLongW(_t22, 0xfffffffc, E0040EADC);
				_t25 =  *0x412af4; // 0xb0076
				 *(_t73 - 0x58) = _t25;
				 *((char*)(_t73 - 0x54)) = 0;
				_t26 =  *0x418664; // 0x45872c
				_t4 = _t26 + 0x20; // 0x1df285c
				 *((intOrPtr*)(_t73 - 0x50)) =  *_t4;
				 *((char*)(_t73 - 0x4c)) = 0;
				_t28 =  *0x418664; // 0x45872c
				_t7 = _t28 + 0x24; // 0x4fc00
				 *((intOrPtr*)(_t73 - 0x48)) =  *_t7;
				 *((char*)(_t73 - 0x44)) = 0;
				E004082D4(L"/SL5=\"$%x,%d,%d,", 2, _t73 - 0x58, _t73 - 0x40);
				_push( *((intOrPtr*)(_t73 - 0x40)));
				_push( *0x418658);
				_push(0x411f9c);
				E0040B84C(_t73 - 0x5c, __ebx, __esi, _t74);
				_push( *((intOrPtr*)(_t73 - 0x5c)));
				E0040513C(_t73 - 0x3c, 4, __edi);
				_t36 =  *0x418670; // 0x0, executed
				E0040EB68(_t36, __ebx, 0x412af0,  *((intOrPtr*)(_t73 - 0x3c)), __edi, __esi, __fp0); // executed
				if( *0x412aec != 0xffffffff) {
					_t50 =  *0x412aec; // 0x0
					E0040EA44(_t50, 0x412af0);
				}
				_pop(_t68);
				 *[fs:eax] = _t68;
				_push(0x411e70);
				_t39 =  *0x41865c; // 0x0
				_t40 = E00403894(_t39);
				if( *0x418670 != 0) {
					_t70 =  *0x418670; // 0x0
					_t40 = E0040E5F4(0, _t70, 0xfa, 0x32); // executed
				}
				if( *0x418668 != 0) {
					_t47 =  *0x418668; // 0x0
					_t40 = RemoveDirectoryW(E00404D24(_t47)); // executed
				}
				if( *0x412af4 != 0) {
					_t46 =  *0x412af4; // 0xb0076
					_t40 = DestroyWindow(_t46); // executed
				}
				if( *0x41864c != 0) {
					_t41 =  *0x41864c; // 0x0
					_t60 =  *0x418650; // 0x1f
					_t69 =  *0x40dcdc; // 0x40dce0
					E00405548(_t41, _t60, _t69);
					_t43 =  *0x41864c; // 0x0
					E00402E20(_t43);
					 *0x41864c = 0;
					return 0;
				}
				return _t40;
			}

0x00411cbf
0x00411cc1
0x00411cc4
0x00411cef
0x00411cf6
0x00411cfc
0x00411d0f
0x00411d23
0x00411d28
0x00411d34
0x00411d3f
0x00411d48
0x00411d4d
0x00411d50
0x00411d54
0x00411d59
0x00411d5c
0x00411d5f
0x00411d63
0x00411d68
0x00411d6b
0x00411d6e
0x00411d7f
0x00411d84
0x00411d87
0x00411d8d
0x00411d95
0x00411d9a
0x00411da5
0x00411db2
0x00411db7
0x00411dc3
0x00411dc5
0x00411dca
0x00411dca
0x00411dd1
0x00411dd4
0x00411dd7
0x00411ddc
0x00411de1
0x00411ded
0x00411dfb
0x00411e03
0x00411e03
0x00411e0f
0x00411e11
0x00411e1c
0x00411e1c
0x00411e28
0x00411e2a
0x00411e30
0x00411e30
0x00411e3c
0x00411e3e
0x00411e43
0x00411e49
0x00411e4f
0x00411e54
0x00411e59
0x00411e60
0x00000000
0x00411e60
0x00411e65

APIs

Part of subcall function 004068EC: CreateWindowExW.USER32 ref: 0040692B

SetWindowLongW.USER32 ref: 00411D3A

Part of subcall function 0040B84C: GetCommandLineW.KERNEL32(00000000,0040B88E,?,?,00000000,?,00411D9A,00411F9C,?), ref: 0040B862

Part of subcall function 0040EB68: CreateProcessW.KERNEL32 ref: 0040EBD8
Part of subcall function 0040EB68: CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,0040EC68,00000000,0040EC58,00000000), ref: 0040EBEC
Part of subcall function 0040EB68: MsgWaitForMultipleObjects.USER32 ref: 0040EC05
Part of subcall function 0040EB68: GetExitCodeProcess.KERNEL32 ref: 0040EC19
Part of subcall function 0040EB68: CloseHandle.KERNEL32(?,?,00412AF0,00000001,?,00000000,000000FF,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040EC22

RemoveDirectoryW.KERNEL32(00000000,00411E70,?,?,?,?,?,?,?,?,?,?,000B0076,000000FC,0040EADC,00000000), ref: 00411E1C
DestroyWindow.USER32(000B0076,00411E70,?,?,?,?,?,?,?,?,?,?,000B0076,000000FC,0040EADC,00000000), ref: 00411E30

Strings

InnoSetupLdrWindow, xrefs: 00411D17
/SL5="$%x,%d,%d,, xrefs: 00411D7A
STATIC, xrefs: 00411D1C

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: 16952bcddd1b38f3790c19f25f79d4b0fd96d0af9fb80ea18251946b4281ff6a
Instruction ID: 0284993d38bd6a7a2d3c7e145b586e9352c0cd3d5aa9cc9140c7bc838ff917fd
Opcode Fuzzy Hash: 16952bcddd1b38f3790c19f25f79d4b0fd96d0af9fb80ea18251946b4281ff6a
Instruction Fuzzy Hash: 5C414671A002409FD714EBA9ED45BDA77E5EB48308F10C53AE600AB2F5DBB89842CB0D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB68, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E0040EB68(void* __eax, void* __ebx, DWORD* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				struct _STARTUPINFOW _v76;
				void* _v88;
				void* _v92;
				int _t23;
				intOrPtr _t49;
				DWORD* _t51;
				void* _t56;

				_v8 = 0;
				_t51 = __ecx;
				_t53 = __edx;
				_t41 = __eax;
				_push(_t56);
				_push(0x40ec3d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t56 + 0xffffffa8;
				_push(0x40ec58);
				_push(__eax);
				_push(0x40ec68);
				_push(__edx);
				E0040513C( &_v8, 4, __ecx);
				E00403250( &_v76, 0x44);
				_v76.cb = 0x44;
				_t23 = CreateProcessW(0, E00404D24(_v8), 0, 0, 0, 0, 0, 0,  &_v76,  &_v92); // executed
				_t58 = _t23;
				if(_t23 == 0) {
					E0040E788(0x6a, _t41, 0, _t53, _t58);
				}
				CloseHandle(_v88);
				do {
					E0040EB3C();
				} while (MsgWaitForMultipleObjects(1,  &_v92, 0, 0xffffffff, 0xff) == 1);
				E0040EB3C();
				GetExitCodeProcess(_v92, _t51); // executed
				CloseHandle(_v92);
				_pop(_t49);
				 *[fs:eax] = _t49;
				_push(E0040EC44);
				return L00404C88( &_v8);
			}

0x0040eb73
0x0040eb76
0x0040eb78
0x0040eb7a
0x0040eb7e
0x0040eb7f
0x0040eb84
0x0040eb87
0x0040eb8a
0x0040eb8f
0x0040eb90
0x0040eb95
0x0040eb9e
0x0040ebad
0x0040ebb2
0x0040ebd8
0x0040ebdd
0x0040ebdf
0x0040ebe3
0x0040ebe3
0x0040ebec
0x0040ebf1
0x0040ebf1
0x0040ec0a
0x0040ec0f
0x0040ec19
0x0040ec22
0x0040ec29
0x0040ec2c
0x0040ec2f
0x0040ec3c

APIs

CreateProcessW.KERNEL32 ref: 0040EBD8
CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,0040EC68,00000000,0040EC58,00000000), ref: 0040EBEC
MsgWaitForMultipleObjects.USER32 ref: 0040EC05
GetExitCodeProcess.KERNEL32 ref: 0040EC19
CloseHandle.KERNEL32(?,?,00412AF0,00000001,?,00000000,000000FF,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040EC22

Part of subcall function 0040E788: GetLastError.KERNEL32(00000000,0040E82F,?,?,00000000), ref: 0040E7AB

Strings

D, xrefs: 0040EBB2

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 2b8cdcb33e3d60b1c62f68ed71d32a98711966e3c34778f9cedb1c4aaaab5d92
Instruction ID: 4cf2f54b5e077032458f067120b074292d1969b63d8e729e11f8563cb9924cf3
Opcode Fuzzy Hash: 2b8cdcb33e3d60b1c62f68ed71d32a98711966e3c34778f9cedb1c4aaaab5d92
Instruction Fuzzy Hash: 6011C0716042086AE700EBE6CC42F9EB7ACDF08314F51083AF601F62C2DA7999108668

Uniqueness

Uniqueness Score: -1.00%

Function 00411688, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00411688(void* __ebx, void* __ecx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _t16;
				intOrPtr _t32;
				intOrPtr _t41;

				_t27 = __ebx;
				_push(0);
				_push(0);
				_push(0);
				_push(_t41);
				_push(0x411752);
				_push( *[fs:eax]);
				 *[fs:eax] = _t41;
				 *0x418518 =  *0x418518 - 1;
				if( *0x418518 < 0) {
					 *0x41851c = E00406728(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"Wow64DisableWow64FsRedirection");
					 *0x418520 = E00406728(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"Wow64RevertWow64FsRedirection");
					if( *0x41851c == 0 ||  *0x418520 == 0) {
						_t16 = 0;
					} else {
						_t16 = 1;
					}
					 *0x418524 = _t16;
					E0040B9D0( &_v12);
					E0040B2E0(_v12,  &_v8);
					E00404F98( &_v8, L"shell32.dll");
					E0040AC84(_v8, _t27, 0x8000); // executed
					E0040BF84(0x4c783afb,  &_v16);
				}
				_pop(_t32);
				 *[fs:eax] = _t32;
				_push(E00411759);
				return L00404C90( &_v16, 3);
			}

0x00411688
0x0041168b
0x0041168d
0x0041168f
0x00411693
0x00411694
0x00411699
0x0041169c
0x0041169f
0x004116a6
0x004116c1
0x004116db
0x004116e7
0x004116f2
0x004116f6
0x004116f6
0x004116f6
0x004116f8
0x00411700
0x0041170b
0x00411718
0x00411725
0x00411732
0x00411732
0x00411739
0x0041173c
0x0041173f
0x00411751

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00411752,?,00000000,00000000,00000000), ref: 004116B6

Part of subcall function 00406728: GetProcAddress.KERNEL32(?,0040BDAE), ref: 0040674C

GetModuleHandleW.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00411752,?,00000000,00000000,00000000), ref: 004116D0

Part of subcall function 00406728: GetProcAddress.KERNEL32(?,00000000), ref: 0040676E

Strings

kernel32.dll, xrefs: 004116B1, 004116CB
Wow64RevertWow64FsRedirection, xrefs: 004116C6
Wow64DisableWow64FsRedirection, xrefs: 004116AC
shell32.dll, xrefs: 00411713

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: a37f4cb0e55432ac59a79c4974b85d51215b0eb934ca5bf149388509e313778d
Instruction ID: 38073493f2a00611f39ba77485dfa139fa8e6d2b5510a228823cd735a641c934
Opcode Fuzzy Hash: a37f4cb0e55432ac59a79c4974b85d51215b0eb934ca5bf149388509e313778d
Instruction Fuzzy Hash: 2211C134600209BFD700ABA6DC42BCD77A9E745748F61847BF600A72E1DB7C5A848B6E

Uniqueness

Uniqueness Score: -1.00%

Function 004018F8, Relevance: 9.0, APIs: 7, Instructions: 298
sleepCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004018F8(signed int __eax) {
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* _t96;
				void** _t99;
				signed int _t104;
				signed int _t109;
				signed int _t110;
				intOrPtr* _t114;
				void* _t116;
				void* _t121;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t135;
				unsigned int _t141;
				signed int _t142;
				void* _t144;
				void* _t147;
				intOrPtr _t148;
				signed int _t150;
				long _t156;
				intOrPtr _t159;
				signed int _t162;

				_t129 =  *0x41304d; // 0x0
				if(__eax > 0xa2c) {
					__eflags = __eax - 0x40a2c;
					if(__eax > 0x40a2c) {
						_pop(_t120);
						__eflags = __eax;
						if(__eax >= 0) {
							_push(_t120);
							_t162 = __eax;
							_t156 = __eax + 0x00010010 - 0x00000001 + 0x00000004 & 0xffff0000;
							_t96 = VirtualAlloc(0, _t156, 0x101000, 4); // executed
							_t121 = _t96;
							if(_t121 != 0) {
								_t147 = _t121;
								 *((intOrPtr*)(_t147 + 8)) = _t162;
								 *(_t147 + 0xc) = _t156 | 0x00000004;
								E0040165C();
								_t99 =  *0x415acc; // 0x415ac8
								 *_t147 = 0x415ac8;
								 *0x415acc = _t121;
								 *(_t147 + 4) = _t99;
								 *_t99 = _t121;
								 *0x415ac4 = 0;
								_t121 = _t121 + 0x10;
							}
							return _t121;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t125 = (__eax + 0x000000d3 & 0xffffff00) + 0x30;
						__eflags = _t129;
						if(__eflags != 0) {
							while(1) {
								asm("lock cmpxchg [0x413a34], ah");
								if(__eflags == 0) {
									goto L42;
								}
								asm("pause");
								__eflags =  *0x4138d5;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									asm("lock cmpxchg [0x413a34], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L42;
							}
						}
						L42:
						_t141 = _t125 - 0xb30;
						_t142 = _t141 >> 0xd;
						_t131 = _t141 >> 8;
						_t104 = 0xffffffff << _t131 &  *(0x413a44 + _t142 * 4);
						__eflags = 0xffffffff;
						if(0xffffffff == 0) {
							_t132 = _t142;
							__eflags = 0xfffffffe << _t132 &  *0x413a40;
							if((0xfffffffe << _t132 &  *0x413a40) == 0) {
								_t133 =  *0x413a3c; // 0xa64f0
								_t134 = _t133 - _t125;
								__eflags = _t134;
								if(_t134 < 0) {
									_t109 = E004015E4(_t125);
								} else {
									_t110 =  *0x413a38; // 0x2666500
									_t109 = _t110 - _t125;
									 *0x413a38 = _t109;
									 *0x413a3c = _t134;
									 *(_t109 - 4) = _t125 | 0x00000002;
								}
								 *0x413a34 = 0;
								return _t109;
							} else {
								asm("bsf edx, eax");
								asm("bsf ecx, eax");
								_t135 = _t132 | _t142 << 0x00000005;
								goto L50;
							}
						} else {
							asm("bsf eax, eax");
							_t135 = _t131 & 0xffffffe0 | _t104;
							L50:
							_push(_t152);
							_push(_t145);
							_t148 = 0x413ac4 + _t135 * 8;
							_t159 =  *((intOrPtr*)(_t148 + 4));
							_t114 =  *((intOrPtr*)(_t159 + 4));
							 *((intOrPtr*)(_t148 + 4)) = _t114;
							 *_t114 = _t148;
							__eflags = _t148 - _t114;
							if(_t148 == _t114) {
								asm("rol eax, cl");
								_t80 = 0x413a44 + _t142 * 4;
								 *_t80 =  *(0x413a44 + _t142 * 4) & 0xfffffffe;
								__eflags =  *_t80;
								if( *_t80 == 0) {
									asm("btr [0x413a40], edx");
								}
							}
							_t150 = 0xfffffff0 &  *(_t159 - 4);
							_t144 = 0xfffffff0 - _t125;
							__eflags = 0xfffffff0;
							if(0xfffffff0 == 0) {
								_t89 =  &((_t159 - 4)[0xfffffffffffffffc]);
								 *_t89 =  *(_t159 - 4 + _t150) & 0x000000f7;
								__eflags =  *_t89;
							} else {
								_t116 = _t125 + _t159;
								 *((intOrPtr*)(_t116 - 4)) = 0xfffffffffffffff3;
								 *(0xfffffff0 + _t116 - 8) = 0xfffffff0;
								__eflags = 0xfffffff0 - 0xb30;
								if(0xfffffff0 >= 0xb30) {
									E00401518(_t116, 0xfffffffffffffff3, _t144);
								}
							}
							 *(_t159 - 4) = _t125 + 2;
							 *0x413a34 = 0;
							return _t159;
						}
					}
				} else {
					__eflags = __cl;
					__eax =  *(__edx + 0x4138dc) & 0x000000ff;
					__ebx = 0x41205c + ( *(__edx + 0x4138dc) & 0x000000ff) * 8;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L5;
							}
							__ebx = __ebx + 0x20;
							__eflags = __ebx;
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__ebx != 0) {
								__ebx = __ebx + 0x20;
								__eflags = __ebx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__ebx != 0) {
									__ebx = __ebx - 0x40;
									asm("pause");
									__eflags =  *0x4138d5;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [ebx], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
								}
							}
							goto L5;
						}
					}
					L5:
					__edx =  *(__ebx + 4);
					__eax =  *(__edx + 8);
					__ecx = 0xfffffff8;
					__eflags = __edx - __ebx;
					if(__edx == __ebx) {
						__edx =  *(__ebx + 0x10);
						__ecx =  *(__ebx + 2) & 0x0000ffff;
						__ecx = ( *(__ebx + 2) & 0x0000ffff) + __eax;
						__eflags = __eax -  *(__ebx + 0xc);
						if(__eax >  *(__ebx + 0xc)) {
							_push(__esi);
							_push(__edi);
							__eflags =  *0x41304d;
							if(__eflags != 0) {
								while(1) {
									__eax = 0x100;
									asm("lock cmpxchg [0x413a34], ah");
									if(__eflags == 0) {
										goto L22;
									}
									asm("pause");
									__eflags =  *0x4138d5;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [0x413a34], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
									goto L22;
								}
							}
							L22:
							 *(__ebx + 1) =  *(__ebx + 1) &  *0x413a40;
							__eflags =  *(__ebx + 1) &  *0x413a40;
							if(( *(__ebx + 1) &  *0x413a40) == 0) {
								__ecx =  *(__ebx + 0x18) & 0x0000ffff;
								__edi =  *0x413a3c; // 0xa64f0
								__eflags = __edi - ( *(__ebx + 0x18) & 0x0000ffff);
								if(__edi < ( *(__ebx + 0x18) & 0x0000ffff)) {
									__eax =  *(__ebx + 0x1a) & 0x0000ffff;
									__edi = __eax;
									__eax = E004015E4(__eax);
									__esi = __eax;
									__eflags = __eax;
									if(__eax != 0) {
										goto L35;
									} else {
										 *0x413a34 = __al;
										 *__ebx = __al;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebx);
										return __eax;
									}
								} else {
									__esi =  *0x413a38; // 0x2666500
									__ecx =  *(__ebx + 0x1a) & 0x0000ffff;
									__edx = __ecx + 0xb30;
									__eflags = __edi - __ecx + 0xb30;
									if(__edi >= __ecx + 0xb30) {
										__edi = __ecx;
									}
									__esi = __esi - __edi;
									 *0x413a3c =  *0x413a3c - __edi;
									 *0x413a38 = __esi;
									goto L35;
								}
							} else {
								asm("bsf eax, esi");
								__esi = __eax * 8;
								__ecx =  *(0x413a44 + __eax * 4);
								asm("bsf ecx, ecx");
								__ecx =  *(0x413a44 + __eax * 4) + __eax * 8 * 4;
								__edi = 0x413ac4 + ( *(0x413a44 + __eax * 4) + __eax * 8 * 4) * 8;
								__esi =  *(__edi + 4);
								__edx =  *(__esi + 4);
								 *(__edi + 4) = __edx;
								 *__edx = __edi;
								__eflags = __edi - __edx;
								if(__edi == __edx) {
									__edx = 0xfffffffe;
									asm("rol edx, cl");
									_t38 = 0x413a44 + __eax * 4;
									 *_t38 =  *(0x413a44 + __eax * 4) & 0xfffffffe;
									__eflags =  *_t38;
									if( *_t38 == 0) {
										asm("btr [0x413a40], eax");
									}
								}
								__edi = 0xfffffff0;
								__edi = 0xfffffff0 &  *(__esi - 4);
								__eflags = 0xfffffff0 - 0x10a60;
								if(0xfffffff0 < 0x10a60) {
									_t52 =  &((__esi - 4)[0xfffffffffffffffc]);
									 *_t52 = (__esi - 4)[0xfffffffffffffffc] & 0x000000f7;
									__eflags =  *_t52;
								} else {
									__edx = __edi;
									__edi =  *(__ebx + 0x1a) & 0x0000ffff;
									__edx = __edx - __edi;
									__eax = __edi + __esi;
									__ecx = __edx + 3;
									 *(__eax - 4) = __ecx;
									 *(__edx + __eax - 8) = __edx;
									__eax = E00401518(__eax, __ecx, __edx);
								}
								L35:
								_t56 = __edi + 6; // 0xa64f6
								__ecx = _t56;
								 *(__esi - 4) = _t56;
								__eax = 0;
								 *0x413a34 = __al;
								 *__esi = __ebx;
								 *((intOrPtr*)(__esi + 8)) = 0;
								 *((intOrPtr*)(__esi + 0xc)) = 1;
								 *(__ebx + 0x10) = __esi;
								_t61 = __esi + 0x20; // 0x2666520
								__eax = _t61;
								__ecx =  *(__ebx + 2) & 0x0000ffff;
								__edx = __ecx + __eax;
								 *(__ebx + 8) = __ecx + __eax;
								__edi = __edi + __esi;
								__edi = __edi - __ecx;
								__eflags = __edi;
								 *(__ebx + 0xc) = __edi;
								 *__ebx = 0;
								 *(__eax - 4) = __esi;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __eax;
							}
						} else {
							_t19 = __edx + 0xc;
							 *_t19 =  *(__edx + 0xc) + 1;
							__eflags =  *_t19;
							 *(__ebx + 8) = __ecx;
							 *__ebx = 0;
							 *(__eax - 4) = __edx;
							_pop(__ebx);
							return __eax;
						}
					} else {
						 *(__edx + 0xc) =  *(__edx + 0xc) + 1;
						__ecx = 0xfffffff8 &  *(__eax - 4);
						__eflags = 0xfffffff8;
						 *(__edx + 8) = 0xfffffff8 &  *(__eax - 4);
						 *(__eax - 4) = __edx;
						if(0xfffffff8 == 0) {
							__ecx =  *(__edx + 4);
							 *(__ecx + 0x14) = __ebx;
							 *(__ebx + 4) = __ecx;
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						} else {
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}

0x00401904
0x0040190a
0x00401b58
0x00401b5d
0x00401c70
0x00401c71
0x00401c73
0x004016a4
0x004016a8
0x004016b4
0x004016c4
0x004016c9
0x004016cd
0x004016cf
0x004016d1
0x004016d7
0x004016da
0x004016df
0x004016e4
0x004016ea
0x004016f0
0x004016f3
0x004016f5
0x004016fc
0x004016fc
0x00401705
0x00401c79
0x00401c79
0x00401c7b
0x00401c7b
0x00401b63
0x00401b6f
0x00401b72
0x00401b74
0x00401b1c
0x00401b21
0x00401b29
0x00000000
0x00000000
0x00401b2b
0x00401b2d
0x00401b34
0x00000000
0x00401b36
0x00401b38
0x00401b42
0x00401b4a
0x00401b4e
0x00000000
0x00401b4e
0x00401b4a
0x00000000
0x00401b34
0x00401b1c
0x00401b76
0x00401b76
0x00401b7e
0x00401b81
0x00401b8b
0x00401b8b
0x00401b92
0x00401ba5
0x00401ba9
0x00401baf
0x00401bc8
0x00401bce
0x00401bce
0x00401bd0
0x00401bee
0x00401bd2
0x00401bd2
0x00401bd7
0x00401bd9
0x00401bde
0x00401be7
0x00401be7
0x00401bf3
0x00401bfb
0x00401bb1
0x00401bb1
0x00401bbb
0x00401bc3
0x00000000
0x00401bc3
0x00401b94
0x00401b97
0x00401b9a
0x00401bfc
0x00401bfc
0x00401bfd
0x00401bfe
0x00401c05
0x00401c08
0x00401c0b
0x00401c0e
0x00401c10
0x00401c12
0x00401c19
0x00401c1b
0x00401c1b
0x00401c1b
0x00401c22
0x00401c24
0x00401c24
0x00401c22
0x00401c30
0x00401c35
0x00401c35
0x00401c37
0x00401c58
0x00401c58
0x00401c58
0x00401c39
0x00401c39
0x00401c3f
0x00401c42
0x00401c46
0x00401c4c
0x00401c4e
0x00401c4e
0x00401c4c
0x00401c60
0x00401c63
0x00401c6f
0x00401c6f
0x00401b92
0x00401910
0x00401910
0x00401912
0x00401919
0x00401920
0x00401978
0x00401978
0x0040197d
0x00401981
0x00000000
0x00000000
0x00401983
0x00401983
0x00401986
0x0040198b
0x0040198f
0x00401991
0x00401991
0x00401994
0x00401999
0x0040199d
0x0040199f
0x004019a2
0x004019a4
0x004019ab
0x00000000
0x004019ad
0x004019af
0x004019b4
0x004019b9
0x004019bd
0x004019c5
0x00000000
0x004019c5
0x004019bd
0x004019ab
0x0040199d
0x00000000
0x0040198f
0x00401978
0x00401922
0x00401922
0x00401925
0x00401928
0x0040192d
0x0040192f
0x00401948
0x0040194b
0x0040194f
0x00401951
0x00401954
0x004019cc
0x004019cd
0x004019ce
0x004019d5
0x004019d7
0x004019d7
0x004019dc
0x004019e4
0x00000000
0x00000000
0x004019e6
0x004019e8
0x004019ef
0x00000000
0x004019f1
0x004019f3
0x004019f8
0x004019fd
0x00401a05
0x00401a09
0x00000000
0x00401a09
0x00401a05
0x00000000
0x004019ef
0x004019d7
0x00401a10
0x00401a14
0x00401a14
0x00401a1a
0x00401a8c
0x00401a90
0x00401a96
0x00401a98
0x00401ac0
0x00401ac4
0x00401ac6
0x00401acb
0x00401acd
0x00401acf
0x00000000
0x00401ad1
0x00401ad1
0x00401ad6
0x00401ad8
0x00401ad9
0x00401ada
0x00401adb
0x00401adb
0x00401a9a
0x00401a9a
0x00401aa0
0x00401aa4
0x00401aaa
0x00401aac
0x00401aae
0x00401aae
0x00401ab0
0x00401ab2
0x00401ab8
0x00000000
0x00401ab8
0x00401a1c
0x00401a1c
0x00401a1f
0x00401a26
0x00401a2d
0x00401a30
0x00401a33
0x00401a3a
0x00401a3d
0x00401a40
0x00401a43
0x00401a45
0x00401a47
0x00401a49
0x00401a4e
0x00401a50
0x00401a50
0x00401a50
0x00401a57
0x00401a59
0x00401a59
0x00401a57
0x00401a60
0x00401a65
0x00401a68
0x00401a6e
0x00401adc
0x00401adc
0x00401adc
0x00401a70
0x00401a70
0x00401a72
0x00401a76
0x00401a78
0x00401a7b
0x00401a7e
0x00401a81
0x00401a85
0x00401a85
0x00401ae1
0x00401ae1
0x00401ae1
0x00401ae4
0x00401ae7
0x00401ae9
0x00401aee
0x00401af0
0x00401af3
0x00401afa
0x00401afd
0x00401afd
0x00401b00
0x00401b04
0x00401b07
0x00401b0a
0x00401b0c
0x00401b0c
0x00401b0e
0x00401b11
0x00401b14
0x00401b17
0x00401b18
0x00401b19
0x00401b1a
0x00401b1a
0x00401956
0x00401956
0x00401956
0x00401956
0x0040195a
0x0040195d
0x00401960
0x00401963
0x00401964
0x00401964
0x00401931
0x00401931
0x00401935
0x00401935
0x00401938
0x0040193b
0x0040193e
0x00401968
0x0040196b
0x0040196e
0x00401971
0x00401974
0x00401975
0x00401940
0x00401940
0x00401943
0x00401944
0x00401944
0x0040193e
0x0040192f

APIs

Sleep.KERNEL32(00000000,?,004018C6), ref: 004019AF
Sleep.KERNEL32(0000000A,00000000,?,004018C6), ref: 004019C5
Sleep.KERNEL32(00000000,?,?,?,004018C6), ref: 004019F3
Sleep.KERNEL32(0000000A,00000000,?,?,?,004018C6), ref: 00401A09

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f51487f3f1496f02d5e4cf641ff69e07689fa8231a26707e284f0f573df8b7fc
Instruction ID: 0cef76587b77e40ce70905fbd12d0a83284de57665f5d39768faeb799c530d07
Opcode Fuzzy Hash: f51487f3f1496f02d5e4cf641ff69e07689fa8231a26707e284f0f573df8b7fc
Instruction Fuzzy Hash: A0C125726012508BCB15CF29D980796BBE0AF85351F18C2BFE485AB3E5D778A941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040ED58, Relevance: 7.6, APIs: 5, Instructions: 80
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ED58(void* __eax) {
				char _v44;
				struct _SYSTEM_INFO _v80;
				long _v84;
				char _v88;
				long _t22;
				int _t28;
				void* _t37;
				struct _MEMORY_BASIC_INFORMATION* _t40;
				long _t41;
				void** _t42;

				_t42 =  &(_v80.dwPageSize);
				 *_t42 = __eax;
				_t40 =  &_v44;
				GetSystemInfo( &_v80); // executed
				_t22 = VirtualQuery( *_t42, _t40, 0x1c);
				if(_t22 == 0) {
					L17:
					return _t22;
				} else {
					while(1) {
						_t22 = _t40->AllocationBase;
						if(_t22 !=  *_t42) {
							goto L17;
						}
						if(_t40->State != 0x1000 || (_t40->Protect & 0x00000001) != 0) {
							L15:
							_t22 = VirtualQuery(_t40->BaseAddress + _t40->RegionSize, _t40, 0x1c);
							if(_t22 == 0) {
								goto L17;
							}
							continue;
						} else {
							_v88 = 0;
							_t41 = _t40->Protect;
							if(_t41 == 1 || _t41 == 2 || _t41 == 0x10 || _t41 == 0x20) {
								_t28 = VirtualProtect(_t40->BaseAddress, _t40->RegionSize, 0x40,  &_v84); // executed
								if(_t28 != 0) {
									_v88 = 1;
								}
							}
							_t37 = 0;
							while(_t37 < _t40->RegionSize) {
								E0040ED50(_t40->BaseAddress + _t37);
								_t37 = _t37 + _v80.dwPageSize;
							}
							if(_v88 != 0) {
								VirtualProtect( *_t40, _t40->RegionSize, _v84,  &_v84); // executed
							}
							goto L15;
						}
					}
					goto L17;
				}
			}

0x0040ed5c
0x0040ed5f
0x0040ed62
0x0040ed6b
0x0040ed77
0x0040ed7e
0x0040ee2a
0x0040ee2a
0x0040ed84
0x0040ee17
0x0040ee17
0x0040ee1d
0x00000000
0x00000000
0x0040ed90
0x0040ee03
0x0040ee0e
0x0040ee15
0x00000000
0x00000000
0x00000000
0x0040ed98
0x0040ed98
0x0040ed9d
0x0040eda3
0x0040edc2
0x0040edc9
0x0040edcb
0x0040edcb
0x0040edc9
0x0040edd0
0x0040ede1
0x0040edd8
0x0040eddd
0x0040eddd
0x0040edeb
0x0040edfe
0x0040edfe
0x00000000
0x0040edeb
0x0040ed90
0x00000000
0x0040ee17

APIs

GetSystemInfo.KERNEL32(?), ref: 0040ED6B
VirtualQuery.KERNEL32(?,?,0000001C,?), ref: 0040ED77
VirtualProtect.KERNEL32(?,?,00000040,0000001C,?,?,0000001C), ref: 0040EDC2
VirtualProtect.KERNEL32(?,?,?,0000001C,?,?,00000040,0000001C,?,?,0000001C), ref: 0040EDFE
VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C,?), ref: 0040EE0E

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: e4b7e33295513277c6011def6b4d957a95426b625841df998cdbff0a236ddac1
Instruction ID: 28f8c6d653e295886548d5e96c56b2ff7251deea64fe8940d300ddfdb745cf46
Opcode Fuzzy Hash: e4b7e33295513277c6011def6b4d957a95426b625841df998cdbff0a236ddac1
Instruction Fuzzy Hash: EA214F71104305AAD720EA5AC885E6BB7E8DF45314F048C2EF595936C1D379E8A4C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 0040E42C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0040E42C(void* __eax, long __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char* _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				int _t30;
				intOrPtr _t63;
				void* _t71;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t76;

				_t71 = __edi;
				_t54 = __ebx;
				_t75 = _t76;
				_t55 = 4;
				do {
					_push(0);
					_push(0);
					_t55 = _t55 - 1;
				} while (_t55 != 0);
				_push(_t55);
				_push(__ebx);
				_t73 = __eax;
				_t78 = 0;
				_push(_t75);
				_push(0x40e521);
				_push( *[fs:eax]);
				 *[fs:eax] = _t76;
				while(1) {
					E0040B9FC( &_v12, _t54, _t55, _t78); // executed
					_t55 = L".tmp";
					E0040E310(0, _t54, L".tmp", _v12, _t71, _t73,  &_v8); // executed
					_t30 = CreateDirectoryW(E00404D24(_v8), 0); // executed
					if(_t30 != 0) {
						break;
					}
					_t54 = GetLastError();
					_t78 = _t54 - 0xb7;
					if(_t54 != 0xb7) {
						_push( &_v16);
						E0040DF38(0x36,  &_v32, _v8);
						_v28 = _v32;
						E00407EE8( &_v36, _t54);
						_v24 = _v36;
						E0040BF84(_t54,  &_v40);
						_v20 = _v40;
						E0040DF08(0x68, 2,  &_v28, 0);
						_t55 = _v16;
						E00409824(_v16, 1);
						E00403F88();
					}
				}
				E00404C98(_t73, _v8);
				__eflags = 0;
				_pop(_t63);
				 *[fs:eax] = _t63;
				_push(E0040E528);
				L00404C90( &_v40, 3);
				return L00404C90( &_v16, 3);
			}

0x0040e42c
0x0040e42c
0x0040e42d
0x0040e42f
0x0040e434
0x0040e434
0x0040e436
0x0040e438
0x0040e438
0x0040e43b
0x0040e43c
0x0040e43e
0x0040e440
0x0040e442
0x0040e443
0x0040e448
0x0040e44b
0x0040e44e
0x0040e455
0x0040e45d
0x0040e464
0x0040e474
0x0040e47b
0x00000000
0x00000000
0x0040e482
0x0040e484
0x0040e48a
0x0040e48f
0x0040e498
0x0040e4a0
0x0040e4ac
0x0040e4b4
0x0040e4bc
0x0040e4c4
0x0040e4d1
0x0040e4d6
0x0040e4e0
0x0040e4e5
0x0040e4e5
0x0040e48a
0x0040e4f4
0x0040e4f9
0x0040e4fb
0x0040e4fe
0x0040e501
0x0040e50e
0x0040e520

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,?,00000000,0040E521,?,?,?,00000003,00000000,00000000,?,00411ABD), ref: 0040E474
GetLastError.KERNEL32(00000000,00000000,?,00000000,0040E521,?,?,?,00000003,00000000,00000000,?,00411ABD), ref: 0040E47D

Strings

.tmp, xrefs: 0040E45D

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: afdb940545854962e9d30b04b46d5208745850b639d8b8f2121a6844242b9503
Instruction ID: 246b7ce823b9bb0a3731469deceed86d61f93e1ef550831fde9cf93969b92c1e
Opcode Fuzzy Hash: afdb940545854962e9d30b04b46d5208745850b639d8b8f2121a6844242b9503
Instruction Fuzzy Hash: BC214975A10109ABDB04EBE6CC41ADEB3F9EB48308F51447BF901B73C1D6396E158B69

Uniqueness

Uniqueness Score: -1.00%

Function 004068EC, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004068EC(long __eax, WCHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32, long _a36) {
				WCHAR* _v8;
				void* _t13;
				struct HWND__* _t24;
				WCHAR* _t29;
				long _t32;

				_v8 = _t29;
				_t32 = __eax;
				_t13 = E00403110();
				_t24 = CreateWindowExW(_t32, __edx, _v8, _a36, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				E00403100(_t13);
				return _t24;
			}

0x004068f3
0x004068f8
0x004068fa
0x0040692b
0x00406934
0x00406940

APIs

CreateWindowExW.USER32 ref: 0040692B

Strings

InnoSetupLdrWindow, xrefs: 004068EF
STATIC, xrefs: 00406929

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateWindow
String ID: InnoSetupLdrWindow$STATIC
API String ID: 716092398-2209255943
Opcode ID: c0992d5dae7087bb7648db7e278b48ea95b6fe98ae32dfbc74ce53748ec999af
Instruction ID: 6351ba77ad7f294675345a051ebbfaa16a65daa534f29d3811ce1de3ec6cb91b
Opcode Fuzzy Hash: c0992d5dae7087bb7648db7e278b48ea95b6fe98ae32dfbc74ce53748ec999af
Instruction Fuzzy Hash: E3F092B2600118BF8B80DE9DDC81EDB7BECEB4C264B05412AFA0CE7201D634ED108BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5F4, Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E5F4(long __eax, intOrPtr __edx, long _a4, long _a8) {
				intOrPtr _v8;
				long _t5;
				long _t9;
				void* _t10;
				void* _t13;
				void* _t15;
				void* _t16;

				_t5 = __eax;
				_v8 = __edx;
				_t9 = __eax;
				_t15 = _t10 - 1;
				if(_t15 < 0) {
					L10:
					return _t5;
				}
				_t16 = _t15 + 1;
				_t13 = 0;
				while(1) {
					_t19 = _t13 - 1;
					if(_t13 != 1) {
						__eflags = _t13 - 1;
						if(__eflags > 0) {
							Sleep(_a4);
						}
					} else {
						Sleep(_a8);
					}
					_t5 = E0040E180(_t9, _v8, _t19); // executed
					if(_t5 != 0) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 2) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 3) {
						goto L10;
					}
					_t13 = _t13 + 1;
					_t16 = _t16 - 1;
					if(_t16 != 0) {
						continue;
					}
					goto L10;
				}
				goto L10;
			}

0x0040e5f4
0x0040e5fb
0x0040e5fe
0x0040e602
0x0040e605
0x0040e653
0x0040e653
0x0040e653
0x0040e607
0x0040e608
0x0040e60a
0x0040e60a
0x0040e60d
0x0040e61a
0x0040e61d
0x0040e623
0x0040e623
0x0040e60f
0x0040e613
0x0040e613
0x0040e62d
0x0040e634
0x00000000
0x00000000
0x0040e636
0x0040e63e
0x00000000
0x00000000
0x0040e640
0x0040e648
0x00000000
0x00000000
0x0040e64a
0x0040e64b
0x0040e64c
0x00000000
0x00000000
0x00000000
0x0040e64c
0x00000000

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,00411E08,000000FA,00000032,00411E70), ref: 0040E613
Sleep.KERNEL32(?,?,?,?,0000000D,?,00411E08,000000FA,00000032,00411E70), ref: 0040E623
GetLastError.KERNEL32(?,?,?,0000000D,?,00411E08,000000FA,00000032,00411E70), ref: 0040E636
GetLastError.KERNEL32(?,?,?,0000000D,?,00411E08,000000FA,00000032,00411E70), ref: 0040E640

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: ea8480e9c076282375cf465efec1e0801a3a61e39bc7705ab48a1ebea68a944c
Instruction ID: e9077bed9970aecdc6b8833c47c5ea53edd0b0e253789bb62b52ff2b734b0da1
Opcode Fuzzy Hash: ea8480e9c076282375cf465efec1e0801a3a61e39bc7705ab48a1ebea68a944c
Instruction Fuzzy Hash: 4AF02B72A0521467D720A5BBAC8295FB298EEB13647545C3BF905F7381C83BDC2143AD

Uniqueness

Uniqueness Score: -1.00%

Function 00404580, Relevance: 4.6, APIs: 3, Instructions: 92
threadCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00404580() {
				void* _t14;
				int _t21;
				void* _t33;
				void* _t47;
				struct HINSTANCE__* _t54;
				void* _t58;

				if( *0x412004 != 0) {
					E00404458();
					E004044F0(_t47);
					 *0x412004 = 0;
				}
				if( *0x415b18 != 0 && GetCurrentThreadId() ==  *0x415b40) {
					E004041DC(0x415b14);
					E004044C4(0x415b14);
				}
				if( *0x00415B0C != 0 ||  *0x413048 == 0) {
					L8:
					if( *((char*)(0x415b0c)) == 2 &&  *0x412000 == 0) {
						 *0x00415AF0 = 0;
					}
					_t14 = E00402EC8();
					_t45 = _t14;
					if(_t14 == 0) {
						L13:
						E00404204(); // executed
						if( *((char*)(0x415b0c)) <= 1 ||  *0x412000 != 0) {
							_t57 =  *0x00415AF4;
							if( *0x00415AF4 != 0) {
								E00406204(_t57);
								_t7 =  *((intOrPtr*)(0x415af4)) + 0x10; // 0x400000
								_t54 =  *_t7;
								_t9 =  *((intOrPtr*)(0x415af4)) + 4; // 0x400000
								if(_t54 !=  *_t9 && _t54 != 0) {
									FreeLibrary(_t54);
								}
							}
						}
						E004041DC(0x415ae4);
						if( *((char*)(0x415b0c)) == 1) {
							 *0x00415B08();
						}
						if( *((char*)(0x415b0c)) != 0) {
							E004044C4(0x415ae4);
						}
						if( *0x415ae4 == 0) {
							if( *0x41302c != 0) {
								 *0x41302c();
							}
							_t21 =  *0x412000; // 0x0
							ExitProcess(_t21); // executed
						}
						memcpy(0x415ae4,  *0x415ae4, 0xc << 2);
						_t58 = _t58 + 0xc;
						0x415ae4 = 0x415ae4;
						goto L8;
					} else {
						do {
							E00403894(_t45);
							_t33 = E00402EC8();
							_t45 = _t33;
						} while (_t33 != 0);
						goto L13;
					}
				} else {
					do {
						 *0x413048 = 0;
						 *((intOrPtr*)( *0x413048))();
					} while ( *0x413048 != 0);
					L8:
					while(1) {
					}
				}
			}

0x00404595
0x00404597
0x0040459c
0x004045a3
0x004045a3
0x004045af
0x004045c3
0x004045cd
0x004045cd
0x004045d6
0x004045ec
0x004045f0
0x004045fd
0x004045fd
0x00404600
0x00404605
0x00404609
0x0040461d
0x0040461d
0x00404626
0x00404631
0x00404636
0x0040463a
0x00404642
0x00404642
0x00404648
0x0040464b
0x00404652
0x00404652
0x0040464b
0x00404636
0x00404659
0x00404662
0x00404664
0x00404664
0x0040466b
0x0040466f
0x0040466f
0x00404677
0x00404680
0x00404682
0x00404682
0x00404688
0x0040468e
0x0040468e
0x0040469f
0x0040469f
0x004046a1
0x00000000
0x0040460b
0x0040460b
0x0040460d
0x00404612
0x00404617
0x00404619
0x00000000
0x0040460b
0x004045dd
0x004045dd
0x004045e3
0x004045e5
0x004045e7
0x00000000
0x004045ec
0x00000000
0x004045ec

APIs

GetCurrentThreadId.KERNEL32 ref: 004045B1
FreeLibrary.KERNEL32(00400000,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000,?,?,?,00000000,0040B7F4,00000000,0040B83D), ref: 00404652
ExitProcess.KERNEL32(00000000,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000,?,?,?,00000000,0040B7F4,00000000,0040B83D), ref: 0040468E

Part of subcall function 004044F0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000,?), ref: 00404529
Part of subcall function 004044F0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000), ref: 0040452F
Part of subcall function 004044F0: GetStdHandle.KERNEL32(000000F5,0040457C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?), ref: 00404544
Part of subcall function 004044F0: WriteFile.KERNEL32(00000000,000000F5,0040457C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?), ref: 0040454A

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 4356c6b92ebc9da1c518ca1677b44757bab9836aa0f193545dcf1a51ed26351d
Instruction ID: 4d782e4c625b569beac7369a61e92c8a12ca43a803c998872a7a01d6faed15f3
Opcode Fuzzy Hash: 4356c6b92ebc9da1c518ca1677b44757bab9836aa0f193545dcf1a51ed26351d
Instruction Fuzzy Hash: 8131A0B06006408BDB31BBB9984875776D4AB99309F14493FE745A72D2E7BDE880CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00404578, Relevance: 4.6, APIs: 3, Instructions: 87
threadCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00404578() {
				intOrPtr* _t14;
				void* _t17;
				int _t24;
				void* _t36;
				void* _t51;
				struct HINSTANCE__* _t59;
				void* _t65;

				 *((intOrPtr*)(_t14 +  *_t14)) =  *((intOrPtr*)(_t14 +  *_t14)) + _t14 +  *_t14;
				if( *0x412004 != 0) {
					E00404458();
					E004044F0(_t51);
					 *0x412004 = 0;
				}
				if( *0x415b18 != 0 && GetCurrentThreadId() ==  *0x415b40) {
					E004041DC(0x415b14);
					E004044C4(0x415b14);
				}
				if( *0x00415B0C != 0 ||  *0x413048 == 0) {
					L10:
					if( *((char*)(0x415b0c)) == 2 &&  *0x412000 == 0) {
						 *0x00415AF0 = 0;
					}
					_t17 = E00402EC8();
					_t49 = _t17;
					if(_t17 == 0) {
						L15:
						E00404204(); // executed
						if( *((char*)(0x415b0c)) <= 1 ||  *0x412000 != 0) {
							_t64 =  *0x00415AF4;
							if( *0x00415AF4 != 0) {
								E00406204(_t64);
								_t7 =  *((intOrPtr*)(0x415af4)) + 0x10; // 0x400000
								_t59 =  *_t7;
								_t9 =  *((intOrPtr*)(0x415af4)) + 4; // 0x400000
								if(_t59 !=  *_t9 && _t59 != 0) {
									FreeLibrary(_t59);
								}
							}
						}
						E004041DC(0x415ae4);
						if( *((char*)(0x415b0c)) == 1) {
							 *0x00415B08();
						}
						if( *((char*)(0x415b0c)) != 0) {
							E004044C4(0x415ae4);
						}
						if( *0x415ae4 == 0) {
							if( *0x41302c != 0) {
								 *0x41302c();
							}
							_t24 =  *0x412000; // 0x0
							ExitProcess(_t24); // executed
						}
						memcpy(0x415ae4,  *0x415ae4, 0xc << 2);
						_t65 = _t65 + 0xc;
						0x415ae4 = 0x415ae4;
						goto L10;
					} else {
						do {
							E00403894(_t49);
							_t36 = E00402EC8();
							_t49 = _t36;
						} while (_t36 != 0);
						goto L15;
					}
				} else {
					do {
						 *0x413048 = 0;
						 *((intOrPtr*)( *0x413048))();
					} while ( *0x413048 != 0);
					L10:
					while(1) {
					}
				}
			}

0x0040457a
0x00404595
0x00404597
0x0040459c
0x004045a3
0x004045a3
0x004045af
0x004045c3
0x004045cd
0x004045cd
0x004045d6
0x004045ec
0x004045f0
0x004045fd
0x004045fd
0x00404600
0x00404605
0x00404609
0x0040461d
0x0040461d
0x00404626
0x00404631
0x00404636
0x0040463a
0x00404642
0x00404642
0x00404648
0x0040464b
0x00404652
0x00404652
0x0040464b
0x00404636
0x00404659
0x00404662
0x00404664
0x00404664
0x0040466b
0x0040466f
0x0040466f
0x00404677
0x00404680
0x00404682
0x00404682
0x00404688
0x0040468e
0x0040468e
0x0040469f
0x0040469f
0x004046a1
0x00000000
0x0040460b
0x0040460b
0x0040460d
0x00404612
0x00404617
0x00404619
0x00000000
0x0040460b
0x004045dd
0x004045dd
0x004045e3
0x004045e5
0x004045e7
0x00000000
0x004045ec
0x00000000
0x004045ec

APIs

GetCurrentThreadId.KERNEL32 ref: 004045B1
FreeLibrary.KERNEL32(00400000,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000,?,?,?,00000000,0040B7F4,00000000,0040B83D), ref: 00404652
ExitProcess.KERNEL32(00000000,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000,?,?,?,00000000,0040B7F4,00000000,0040B83D), ref: 0040468E

Part of subcall function 004044F0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000,?), ref: 00404529
Part of subcall function 004044F0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000), ref: 0040452F
Part of subcall function 004044F0: GetStdHandle.KERNEL32(000000F5,0040457C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?), ref: 00404544
Part of subcall function 004044F0: WriteFile.KERNEL32(00000000,000000F5,0040457C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?), ref: 0040454A

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: bf4da6e25b82f27659905996c7380b79b83ab0ced5a03e697dd3e7aa7360de26
Instruction ID: ae86e3c572180b17c01ff7deee3723e6db1901e31400f3d11ea795e357d1f3a4
Opcode Fuzzy Hash: bf4da6e25b82f27659905996c7380b79b83ab0ced5a03e697dd3e7aa7360de26
Instruction Fuzzy Hash: 90317EB06007408BDB31BBA995483577BE06B9A309F04493FE745A72D2E7BDE890CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040457C, Relevance: 4.6, APIs: 3, Instructions: 85
threadCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040457C() {
				void* _t16;
				int _t23;
				void* _t35;
				void* _t50;
				struct HINSTANCE__* _t58;
				void* _t64;

				if( *0x412004 != 0) {
					E00404458();
					E004044F0(_t50);
					 *0x412004 = 0;
				}
				if( *0x415b18 != 0 && GetCurrentThreadId() ==  *0x415b40) {
					E004041DC(0x415b14);
					E004044C4(0x415b14);
				}
				if( *0x00415B0C != 0 ||  *0x413048 == 0) {
					L9:
					if( *((char*)(0x415b0c)) == 2 &&  *0x412000 == 0) {
						 *0x00415AF0 = 0;
					}
					_t16 = E00402EC8();
					_t48 = _t16;
					if(_t16 == 0) {
						L14:
						E00404204(); // executed
						if( *((char*)(0x415b0c)) <= 1 ||  *0x412000 != 0) {
							_t63 =  *0x00415AF4;
							if( *0x00415AF4 != 0) {
								E00406204(_t63);
								_t7 =  *((intOrPtr*)(0x415af4)) + 0x10; // 0x400000
								_t58 =  *_t7;
								_t9 =  *((intOrPtr*)(0x415af4)) + 4; // 0x400000
								if(_t58 !=  *_t9 && _t58 != 0) {
									FreeLibrary(_t58);
								}
							}
						}
						E004041DC(0x415ae4);
						if( *((char*)(0x415b0c)) == 1) {
							 *0x00415B08();
						}
						if( *((char*)(0x415b0c)) != 0) {
							E004044C4(0x415ae4);
						}
						if( *0x415ae4 == 0) {
							if( *0x41302c != 0) {
								 *0x41302c();
							}
							_t23 =  *0x412000; // 0x0
							ExitProcess(_t23); // executed
						}
						memcpy(0x415ae4,  *0x415ae4, 0xc << 2);
						_t64 = _t64 + 0xc;
						0x415ae4 = 0x415ae4;
						goto L9;
					} else {
						do {
							E00403894(_t48);
							_t35 = E00402EC8();
							_t48 = _t35;
						} while (_t35 != 0);
						goto L14;
					}
				} else {
					do {
						 *0x413048 = 0;
						 *((intOrPtr*)( *0x413048))();
					} while ( *0x413048 != 0);
					L9:
					while(1) {
					}
				}
			}

APIs

GetCurrentThreadId.KERNEL32 ref: 004045B1
FreeLibrary.KERNEL32(00400000,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000,?,?,?,00000000,0040B7F4,00000000,0040B83D), ref: 00404652
ExitProcess.KERNEL32(00000000,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000,?,?,?,00000000,0040B7F4,00000000,0040B83D), ref: 0040468E

Part of subcall function 004044F0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000,?), ref: 00404529
Part of subcall function 004044F0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000), ref: 0040452F
Part of subcall function 004044F0: GetStdHandle.KERNEL32(000000F5,0040457C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?), ref: 00404544
Part of subcall function 004044F0: WriteFile.KERNEL32(00000000,000000F5,0040457C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?), ref: 0040454A

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: ef303358ffc1e6e0198b2a0a684d254f0c5984d34b54cf5c49c6103e49519b38
Instruction ID: 381d49ba10d3c5657357f4fb8878975e958cf176e4fcae55fd6a7565d347896d
Opcode Fuzzy Hash: ef303358ffc1e6e0198b2a0a684d254f0c5984d34b54cf5c49c6103e49519b38
Instruction Fuzzy Hash: 0A31A1B06007408BDB31BBB995483577AE06B99309F04493FE745A72D2E7BDE890CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00402D08, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402D08() {
				intOrPtr _t13;
				int _t14;
				void* _t16;
				int _t20;
				void* _t21;
				void* _t22;
				void* _t23;

				_t23 =  *0x00413A28;
				while(_t23 != 0x413a24) {
					VirtualFree(_t23, 0, 0x8000); // executed
					_t23 =  *(_t23 + 4);
				}
				_t21 = 0x37;
				_t13 = 0x41205c;
				do {
					 *((intOrPtr*)(_t13 + 0x14)) = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t13;
					 *((intOrPtr*)(_t13 + 8)) = 1;
					 *((intOrPtr*)(_t13 + 0xc)) = 0;
					_t13 = _t13 + 0x20;
					_t21 = _t21 - 1;
				} while (_t21 != 0);
				 *0x413a24 = 0x413a24;
				 *0x00413A28 = 0x413a24;
				_t22 = 0x400;
				_t20 = 0x413ac4;
				do {
					_t14 = _t20;
					 *_t14 = _t14;
					_t8 = _t14 + 4; // 0x413ac4
					 *_t8 = _t14;
					_t20 = _t20 + 8;
					_t22 = _t22 - 1;
				} while (_t22 != 0);
				_t16 =  *0x00415ACC;
				while(_t16 != 0x415ac8) {
					_t10 = _t16 + 4; // 0x415ac8
					_t14 = VirtualFree(_t16, 0, 0x8000);
					_t16 =  *_t10;
				}
				 *0x415ac8 = 0x415ac8;
				 *0x00415ACC = 0x415ac8;
				return _t14;
			}

0x00402d16
0x00402d2d
0x00402d26
0x00402d2b
0x00402d2b
0x00402d31
0x00402d36
0x00402d3b
0x00402d3d
0x00402d42
0x00402d45
0x00402d4e
0x00402d51
0x00402d54
0x00402d54
0x00402d57
0x00402d59
0x00402d5c
0x00402d61
0x00402d66
0x00402d66
0x00402d68
0x00402d6a
0x00402d6a
0x00402d6d
0x00402d70
0x00402d70
0x00402d73
0x00402d8a
0x00402d78
0x00402d83
0x00402d88
0x00402d88
0x00402d8e
0x00402d90
0x00402d97

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00402DE8,004064E4,00000000,00406506), ref: 00402D26
VirtualFree.KERNEL32(00415AC8,00000000,00008000,?,00000000,00008000,?,?,?,?,00402DE8,004064E4,00000000,00406506), ref: 00402D83

Strings

$:A, xrefs: 00402D0C

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeVirtual
String ID: $:A
API String ID: 1263568516-3833043025
Opcode ID: 2d2d782df9233161c06dec7e4b6ee0fe064feae8b47c0467e0eab097918889d1
Instruction ID: d24d952728fcc3a9646f3ebb449162ef2ce13bf0a669e40d3a5f1eeb3db0775a
Opcode Fuzzy Hash: 2d2d782df9233161c06dec7e4b6ee0fe064feae8b47c0467e0eab097918889d1
Instruction Fuzzy Hash: F01161B13006009BD7248F089A84B66BAA5EF89754F25C07FE209AF3C1D678EC42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004015E4, Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 38
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004015E4(signed int __eax) {
				void* _t4;
				intOrPtr _t7;
				signed int _t8;
				void* _t10;
				void** _t15;
				void* _t17;

				_t8 = __eax;
				E00401578(__eax);
				_t4 = VirtualAlloc(0, 0x13fff0, 0x1000, 4); // executed
				if(_t4 == 0) {
					 *0x413a3c = 0;
					return 0;
				} else {
					_t15 =  *0x413a28; // 0x413a24
					_t10 = _t4;
					 *_t10 = 0x413a24;
					 *0x413a28 = _t4;
					 *(_t10 + 4) = _t15;
					 *_t15 = _t4;
					_t17 = _t4 + 0x13fff0;
					 *((intOrPtr*)(_t17 - 4)) = 2;
					 *0x413a3c = 0x13ffe0 - _t8;
					_t7 = _t17 - _t8;
					 *0x413a38 = _t7;
					 *(_t7 - 4) = _t8 | 0x00000002;
					return _t7;
				}
			}

0x004015e5
0x004015e7
0x004015fa
0x00401601
0x00401652
0x0040165a
0x00401603
0x00401603
0x00401609
0x0040160b
0x00401611
0x00401616
0x00401619
0x0040161d
0x00401628
0x00401635
0x0040163d
0x0040163f
0x0040164c
0x0040164f
0x0040164f

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00401BF3,?,004018C6), ref: 004015FA

Strings

$:A, xrefs: 0040160B
$:A, xrefs: 00401603, 00401611

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: $:A$$:A
API String ID: 4275171209-1384836841
Opcode ID: 39421edb908c6995d62f2c0b4cea7b3dead7872c1aad425fc2c1c6bc86b03942
Instruction ID: cf32fbc5601a1205f328c6ffb622e927ebfe32a850b6ecb500ba2c71dea074df
Opcode Fuzzy Hash: 39421edb908c6995d62f2c0b4cea7b3dead7872c1aad425fc2c1c6bc86b03942
Instruction Fuzzy Hash: 49F06DF1B103405FDB04DF7A9E817427BD6AB89396F20C03EE549EB7A8E77585418B08

Uniqueness

Uniqueness Score: -1.00%

Function 00411A2D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119
windowCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00411A2D(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _t25;
				intOrPtr _t30;
				intOrPtr _t36;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr _t43;
				intOrPtr _t46;
				intOrPtr _t50;
				intOrPtr _t52;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t60;
				WCHAR* _t62;
				void* _t68;
				intOrPtr _t69;
				void* _t73;
				intOrPtr _t76;
				intOrPtr _t80;
				intOrPtr _t86;
				intOrPtr _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				intOrPtr _t97;

				_t95 = __esi;
				_t94 = __edi;
				_t68 = __ebx;
				_pop(_t80);
				_pop(_t71);
				 *[fs:eax] = _t80;
				E0040EAB8(_t71);
				if(( *0x418643 & 0x00000001) == 0 &&  *0x412ae4 == 0) {
					_t60 =  *0x412c0c; // 0x4181a0
					_t3 = _t60 + 0x274; // 0x0
					_t62 = E00404D24( *_t3);
					_t71 = _t96 - 0x28;
					_t80 =  *0x41852c; // 0x0
					E0040DF38(0xa1, _t96 - 0x28, _t80);
					if(MessageBoxW(0, E00404D24( *((intOrPtr*)(_t96 - 0x28))), _t62, 0x24) != 6) {
						 *0x412af0 = 2;
						E00409810();
					}
				}
				E004030BC();
				E0040E42C(_t96 - 0x2c, _t68, _t80, _t94, _t95); // executed
				E00404C98(0x418668,  *((intOrPtr*)(_t96 - 0x2c)));
				_t25 =  *0x418658; // 0x0
				E0040B5D4(_t25, _t71, _t96 - 0x34);
				E0040B348( *((intOrPtr*)(_t96 - 0x34)), _t68, _t96 - 0x30, L".tmp", _t94, _t95);
				_push( *((intOrPtr*)(_t96 - 0x30)));
				_t30 =  *0x418668; // 0x0
				E0040B2E0(_t30, _t96 - 0x38);
				_pop(_t73);
				E00405058(0x41866c, _t73,  *((intOrPtr*)(_t96 - 0x38)));
				_t86 =  *0x41866c; // 0x0
				E00404C98(0x418670, _t86);
				_t36 =  *0x418664; // 0x45872c
				_t14 = _t36 + 0x14; // 0x1e17a81
				_t37 =  *0x41865c; // 0x0
				E0040C220(_t37,  *_t14);
				_push(_t96);
				_push(0x411cc9);
				_push( *[fs:edx]);
				 *[fs:edx] = _t97;
				 *0x4186b4 = 0;
				_t41 = E0040C238(1, 0, 1, 0); // executed
				 *0x418660 = _t41;
				_push(_t96);
				_push(0x411cb8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t97;
				_t43 =  *0x418664; // 0x45872c
				_t15 = _t43 + 0x18; // 0x153e00
				 *0x4186b4 = E00402E04( *_t15);
				_t46 =  *0x418664; // 0x45872c
				_t16 = _t46 + 0x18; // 0x153e00
				_t69 =  *0x4186b4; // 0x7fd50010
				E00403250(_t69,  *_t16);
				_push(_t96);
				_push(0x411c07);
				_push( *[fs:eax]);
				 *[fs:eax] = _t97;
				_t50 =  *0x40cbc0; // 0x40cc18
				_t76 =  *0x41865c; // 0x0
				_t52 = E0040C854(_t76, 1, _t50); // executed
				 *0x4186b8 = _t52;
				_push(_t96);
				_push(0x411bf6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t97;
				_t54 =  *0x418664; // 0x45872c
				_t17 = _t54 + 0x18; // 0x153e00
				_t55 =  *0x4186b8; // 0x2676630
				E0040CB34(_t55,  *_t17, _t69);
				_pop(_t93);
				 *[fs:eax] = _t93;
				_push(E00411BFD);
				_t58 =  *0x4186b8; // 0x2676630
				return E00403894(_t58);
			}

0x00411a2d
0x00411a2d
0x00411a2d
0x00411a2f
0x00411a31
0x00411a32
0x00411a52
0x00411a5e
0x00411a6b
0x00411a70
0x00411a76
0x00411a7c
0x00411a7f
0x00411a87
0x00411a9f
0x00411aa1
0x00411aab
0x00411aab
0x00411a9f
0x00411ab0
0x00411ab8
0x00411ac5
0x00411acd
0x00411ad2
0x00411ae2
0x00411aea
0x00411aee
0x00411af3
0x00411b00
0x00411b01
0x00411b0b
0x00411b11
0x00411b16
0x00411b1b
0x00411b1e
0x00411b23
0x00411b2a
0x00411b2b
0x00411b30
0x00411b33
0x00411b38
0x00411b50
0x00411b55
0x00411b5c
0x00411b5d
0x00411b62
0x00411b65
0x00411b68
0x00411b6d
0x00411b75
0x00411b7a
0x00411b7f
0x00411b82
0x00411b8c
0x00411b93
0x00411b94
0x00411b99
0x00411b9c
0x00411b9f
0x00411ba5
0x00411bb2
0x00411bb7
0x00411bbe
0x00411bbf
0x00411bc4
0x00411bc7
0x00411bca
0x00411bcf
0x00411bd4
0x00411bd9
0x00411be0
0x00411be3
0x00411be6
0x00411beb
0x00411bf5

APIs

MessageBoxW.USER32(00000000,00000000,00000000,00000024), ref: 00411A97

Strings

.tmp, xrefs: 00411ADD

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Message
String ID: .tmp
API String ID: 2030045667-2986845003
Opcode ID: 84cba8a9e6be23ba913e0052a72dc072440df6c7ba09a93b7f3f926190c62f5f
Instruction ID: e09d7a7b5aa06682260f01fa9f72d0e5a359e86d6403969b0331f563822a06e3
Opcode Fuzzy Hash: 84cba8a9e6be23ba913e0052a72dc072440df6c7ba09a93b7f3f926190c62f5f
Instruction Fuzzy Hash: B6417B746012409FD711EF65ED92E9A77B5EB49308B21853EF900A77A1DB38AC41CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 00411A3F, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119
windowCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00411A3F(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _t28;
				intOrPtr _t33;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t44;
				intOrPtr _t46;
				intOrPtr _t49;
				intOrPtr _t53;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t61;
				intOrPtr _t63;
				WCHAR* _t65;
				intOrPtr _t72;
				void* _t75;
				intOrPtr _t78;
				intOrPtr _t82;
				intOrPtr _t88;
				intOrPtr _t95;
				void* _t96;
				void* _t97;
				void* _t98;
				intOrPtr _t99;

				_t97 = __esi;
				_t96 = __edi;
				_t73 = __ecx;
				_t71 = __ebx;
				asm("les eax, [eax]");
				asm("sbb al, [ecx]");
				E0040EC70();
				E0040404C();
				E0040EAB8(_t73);
				if(( *0x418643 & 0x00000001) == 0 &&  *0x412ae4 == 0) {
					_t63 =  *0x412c0c; // 0x4181a0
					_t3 = _t63 + 0x274; // 0x0
					_t65 = E00404D24( *_t3);
					_t73 = _t98 - 0x28;
					_t82 =  *0x41852c; // 0x0
					E0040DF38(0xa1, _t98 - 0x28, _t82);
					if(MessageBoxW(0, E00404D24( *((intOrPtr*)(_t98 - 0x28))), _t65, 0x24) != 6) {
						 *0x412af0 = 2;
						E00409810();
					}
				}
				E004030BC();
				E0040E42C(_t98 - 0x2c, _t71, _t82, _t96, _t97); // executed
				E00404C98(0x418668,  *((intOrPtr*)(_t98 - 0x2c)));
				_t28 =  *0x418658; // 0x0
				E0040B5D4(_t28, _t73, _t98 - 0x34);
				E0040B348( *((intOrPtr*)(_t98 - 0x34)), _t71, _t98 - 0x30, L".tmp", _t96, _t97);
				_push( *((intOrPtr*)(_t98 - 0x30)));
				_t33 =  *0x418668; // 0x0
				E0040B2E0(_t33, _t98 - 0x38);
				_pop(_t75);
				E00405058(0x41866c, _t75,  *((intOrPtr*)(_t98 - 0x38)));
				_t88 =  *0x41866c; // 0x0
				E00404C98(0x418670, _t88);
				_t39 =  *0x418664; // 0x45872c
				_t14 = _t39 + 0x14; // 0x1e17a81
				_t40 =  *0x41865c; // 0x0
				E0040C220(_t40,  *_t14);
				_push(_t98);
				_push(0x411cc9);
				_push( *[fs:edx]);
				 *[fs:edx] = _t99;
				 *0x4186b4 = 0;
				_t44 = E0040C238(1, 0, 1, 0); // executed
				 *0x418660 = _t44;
				_push(_t98);
				_push(0x411cb8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t99;
				_t46 =  *0x418664; // 0x45872c
				_t15 = _t46 + 0x18; // 0x153e00
				 *0x4186b4 = E00402E04( *_t15);
				_t49 =  *0x418664; // 0x45872c
				_t16 = _t49 + 0x18; // 0x153e00
				_t72 =  *0x4186b4; // 0x7fd50010
				E00403250(_t72,  *_t16);
				_push(_t98);
				_push(0x411c07);
				_push( *[fs:eax]);
				 *[fs:eax] = _t99;
				_t53 =  *0x40cbc0; // 0x40cc18
				_t78 =  *0x41865c; // 0x0
				_t55 = E0040C854(_t78, 1, _t53); // executed
				 *0x4186b8 = _t55;
				_push(_t98);
				_push(0x411bf6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t99;
				_t57 =  *0x418664; // 0x45872c
				_t17 = _t57 + 0x18; // 0x153e00
				_t58 =  *0x4186b8; // 0x2676630
				E0040CB34(_t58,  *_t17, _t72);
				_pop(_t95);
				 *[fs:eax] = _t95;
				_push(E00411BFD);
				_t61 =  *0x4186b8; // 0x2676630
				return E00403894(_t61);
			}

0x00411a3f
0x00411a3f
0x00411a3f
0x00411a3f
0x00411a41
0x00411a45
0x00411a48
0x00411a4d
0x00411a52
0x00411a5e
0x00411a6b
0x00411a70
0x00411a76
0x00411a7c
0x00411a7f
0x00411a87
0x00411a9f
0x00411aa1
0x00411aab
0x00411aab
0x00411a9f
0x00411ab0
0x00411ab8
0x00411ac5
0x00411acd
0x00411ad2
0x00411ae2
0x00411aea
0x00411aee
0x00411af3
0x00411b00
0x00411b01
0x00411b0b
0x00411b11
0x00411b16
0x00411b1b
0x00411b1e
0x00411b23
0x00411b2a
0x00411b2b
0x00411b30
0x00411b33
0x00411b38
0x00411b50
0x00411b55
0x00411b5c
0x00411b5d
0x00411b62
0x00411b65
0x00411b68
0x00411b6d
0x00411b75
0x00411b7a
0x00411b7f
0x00411b82
0x00411b8c
0x00411b93
0x00411b94
0x00411b99
0x00411b9c
0x00411b9f
0x00411ba5
0x00411bb2
0x00411bb7
0x00411bbe
0x00411bbf
0x00411bc4
0x00411bc7
0x00411bca
0x00411bcf
0x00411bd4
0x00411bd9
0x00411be0
0x00411be3
0x00411be6
0x00411beb
0x00411bf5

APIs

MessageBoxW.USER32(00000000,00000000,00000000,00000024), ref: 00411A97

Strings

.tmp, xrefs: 00411ADD

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Message
String ID: .tmp
API String ID: 2030045667-2986845003
Opcode ID: 71dd45137f65d40e1481c5f8909904dabe0fcda177d3ad4e8c649083b5a8cc13
Instruction ID: 7cd60e15784bbaac470906b5693fab6dc2657f3b4bbf9efa92049d35e9a2de87
Opcode Fuzzy Hash: 71dd45137f65d40e1481c5f8909904dabe0fcda177d3ad4e8c649083b5a8cc13
Instruction Fuzzy Hash: 01416A746012449FD700EF65ED92E9A77B5EB49308B21857EF900A77A2CB38AC41CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040E180, Relevance: 3.0, APIs: 2, Instructions: 42
fileCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0040E180(void* __eax, void* __edx, void* __eflags) {
				int _v8;
				char _v16;
				long _v20;
				int _t13;
				intOrPtr _t27;
				void* _t32;
				void* _t34;
				intOrPtr _t35;

				_t32 = _t34;
				_t35 = _t34 + 0xfffffff0;
				if(E0040E134(__eax,  &_v16) != 0) {
					_push(_t32);
					_push(0x40e1dd);
					_push( *[fs:eax]);
					 *[fs:eax] = _t35;
					_t13 = DeleteFileW(E00404D24(__edx)); // executed
					_v8 = _t13;
					_v20 = GetLastError();
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(E0040E1E4);
					return E0040E170( &_v16);
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x0040e181
0x0040e183
0x0040e198
0x0040e1a3
0x0040e1a4
0x0040e1a9
0x0040e1ac
0x0040e1b7
0x0040e1bc
0x0040e1c4
0x0040e1c9
0x0040e1cc
0x0040e1cf
0x0040e1dc
0x0040e19a
0x0040e19c
0x0040e1f5
0x0040e1f5

APIs

DeleteFileW.KERNEL32(00000000,00000000,0040E1DD,?,0000000D,00000000), ref: 0040E1B7
GetLastError.KERNEL32(00000000,00000000,0040E1DD,?,0000000D,00000000), ref: 0040E1BF

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: fdcab6c749f36d79bccf4ed63f6bf4538230c3d75133db45ec97e27341047ba6
Instruction ID: 392c08ceaeb7ffef5a4418ba4f3d171e8fa1659d9c06a632e905dedf7b71b17b
Opcode Fuzzy Hash: fdcab6c749f36d79bccf4ed63f6bf4538230c3d75133db45ec97e27341047ba6
Instruction Fuzzy Hash: B8F0FC71A04308AFDB00DFB69C4189DB3E8DB497147514EBBF814F7781EA3D5E205598

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC82, Relevance: 3.0, APIs: 2, Instructions: 34
libraryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040AC82(void* __eax, void* __ebx, int __edx) {
				struct HINSTANCE__* _v12;
				int _v16;
				int _t4;
				struct HINSTANCE__* _t9;
				void* _t12;
				intOrPtr _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;

				_t18 = _t19;
				_t20 = _t19 + 0xfffffff4;
				_t12 = __eax;
				_t4 = SetErrorMode(__edx); // executed
				_v16 = _t4;
				_push(_t18);
				_push(0x40acf6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				asm("fnstcw word [ebp-0x2]");
				_push(_t18);
				_push(0x40acd8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				_t9 = LoadLibraryW(E00404D24(_t12)); // executed
				_v12 = _t9;
				_pop(_t16);
				 *[fs:eax] = _t16;
				_push(E0040ACDF);
				asm("fclex");
				asm("fldcw word [ebp-0x2]");
				return 0;
			}

0x0040ac85
0x0040ac87
0x0040ac8b
0x0040ac8e
0x0040ac93
0x0040ac98
0x0040ac99
0x0040ac9e
0x0040aca1
0x0040aca4
0x0040aca9
0x0040acaa
0x0040acaf
0x0040acb2
0x0040acbd
0x0040acc2
0x0040acc7
0x0040acca
0x0040accd
0x0040acd2
0x0040acd4
0x0040acd7

APIs

SetErrorMode.KERNEL32 ref: 0040AC8E
LoadLibraryW.KERNEL32(00000000,00000000,0040ACD8,?,00000000,0040ACF6), ref: 0040ACBD

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 4a0d345e161d9aa04fb204192aef2064e70d77f987adaa7dd9b6adf39232b4dc
Instruction ID: 446626037349bff6c3d3fc7edf50d58ff88a58da299c323ca587a544ae1629d3
Opcode Fuzzy Hash: 4a0d345e161d9aa04fb204192aef2064e70d77f987adaa7dd9b6adf39232b4dc
Instruction Fuzzy Hash: 3AF08970A047447FEB115F768C5242AB6ECE74DB047538876FD01E29D1E53D4C20D569

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC84, Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040AC84(void* __eax, void* __ebx, int __edx) {
				struct HINSTANCE__* _v12;
				int _v16;
				int _t4;
				struct HINSTANCE__* _t9;
				void* _t12;
				intOrPtr _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;

				_t18 = _t19;
				_t20 = _t19 + 0xfffffff4;
				_t12 = __eax;
				_t4 = SetErrorMode(__edx); // executed
				_v16 = _t4;
				_push(_t18);
				_push(0x40acf6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				asm("fnstcw word [ebp-0x2]");
				_push(_t18);
				_push(0x40acd8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				_t9 = LoadLibraryW(E00404D24(_t12)); // executed
				_v12 = _t9;
				_pop(_t16);
				 *[fs:eax] = _t16;
				_push(E0040ACDF);
				asm("fclex");
				asm("fldcw word [ebp-0x2]");
				return 0;
			}

APIs

SetErrorMode.KERNEL32 ref: 0040AC8E
LoadLibraryW.KERNEL32(00000000,00000000,0040ACD8,?,00000000,0040ACF6), ref: 0040ACBD

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: d906d2629e9325c76dbb444b949735e4ca7d417c166a0045cd3f60122fff6cd7
Instruction ID: 93d40f3431e9079428ff9cf159756719ddb02882c84a7d17cb6b63846cc3cebc
Opcode Fuzzy Hash: d906d2629e9325c76dbb444b949735e4ca7d417c166a0045cd3f60122fff6cd7
Instruction Fuzzy Hash: 7CF089709047447FDB115F768C5241AB6ECE74DB047538876F901A29D1E53D4820D569

Uniqueness

Uniqueness Score: -1.00%

Function 00411E6B, Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411E6B(void* __edx) {
				intOrPtr _t1;
				int _t2;
				intOrPtr _t3;
				intOrPtr _t5;
				struct HWND__* _t8;
				intOrPtr _t9;
				intOrPtr _t12;
				intOrPtr _t15;
				intOrPtr _t16;

				_t1 =  *0x41865c; // 0x0
				_t2 = E00403894(_t1);
				if( *0x418670 != 0) {
					_t16 =  *0x418670; // 0x0
					_t2 = E0040E5F4(0, _t16, 0xfa, 0x32); // executed
				}
				if( *0x418668 != 0) {
					_t9 =  *0x418668; // 0x0
					_t2 = RemoveDirectoryW(E00404D24(_t9)); // executed
				}
				if( *0x412af4 != 0) {
					_t8 =  *0x412af4; // 0xb0076
					_t2 = DestroyWindow(_t8); // executed
				}
				if( *0x41864c != 0) {
					_t3 =  *0x41864c; // 0x0
					_t12 =  *0x418650; // 0x1f
					_t15 =  *0x40dcdc; // 0x40dce0
					E00405548(_t3, _t12, _t15);
					_t5 =  *0x41864c; // 0x0
					E00402E20(_t5);
					 *0x41864c = 0;
					return 0;
				}
				return _t2;
			}

0x00411ddc
0x00411de1
0x00411ded
0x00411dfb
0x00411e03
0x00411e03
0x00411e0f
0x00411e11
0x00411e1c
0x00411e1c
0x00411e28
0x00411e2a
0x00411e30
0x00411e30
0x00411e3c
0x00411e3e
0x00411e43
0x00411e49
0x00411e4f
0x00411e54
0x00411e59
0x00411e60
0x00000000
0x00411e60
0x00411e65

APIs

RemoveDirectoryW.KERNEL32(00000000,00411E70,?,?,?,?,?,?,?,?,?,?,000B0076,000000FC,0040EADC,00000000), ref: 00411E1C
DestroyWindow.USER32(000B0076,00411E70,?,?,?,?,?,?,?,?,?,?,000B0076,000000FC,0040EADC,00000000), ref: 00411E30

Part of subcall function 0040E5F4: Sleep.KERNEL32(?,?,?,?,0000000D,?,00411E08,000000FA,00000032,00411E70), ref: 0040E613
Part of subcall function 0040E5F4: GetLastError.KERNEL32(?,?,?,0000000D,?,00411E08,000000FA,00000032,00411E70), ref: 0040E636
Part of subcall function 0040E5F4: GetLastError.KERNEL32(?,?,?,0000000D,?,00411E08,000000FA,00000032,00411E70), ref: 0040E640

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$DestroyDirectoryRemoveSleepWindow
String ID:
API String ID: 2192421792-0
Opcode ID: 16fc73fdca24aa4436a94be1ebbc9f723652ce6a0d15cc46796c2bc3ac6acaf7
Instruction ID: ec8e02360bfcc356e1db38aad78d5ec852a00ce1a99b6c7dca730568abe77d05
Opcode Fuzzy Hash: 16fc73fdca24aa4436a94be1ebbc9f723652ce6a0d15cc46796c2bc3ac6acaf7
Instruction Fuzzy Hash: 6201C9B46412009BD725EF69ED49B9A33E0AB04309F10C53EE601962F5CE7C9885DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3D0, Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040C3D0(intOrPtr* __eax, void* __edx) {
				long _v16;
				long _v20;
				long _t8;
				intOrPtr* _t10;

				asm("movsd");
				asm("movsd");
				_t10 = __eax;
				_t8 = SetFilePointer( *(__eax + 4), _v20,  &_v16, 0); // executed
				if(_t8 == 0xffffffff) {
					_t8 = GetLastError();
					if(_t8 != 0) {
						_t8 = E0040C1E4( *_t10);
					}
				}
				return _t8;
			}

0x0040c3db
0x0040c3dc
0x0040c3dd
0x0040c3ef
0x0040c3f7
0x0040c3f9
0x0040c400
0x0040c404
0x0040c404
0x0040c400
0x0040c40e

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040C3EF
GetLastError.KERNEL32(?,?,?,00000000), ref: 0040C3F9

Part of subcall function 0040C1E4: GetLastError.KERNEL32(0040C0A4,0040C287,?,?,00000000,?,004118BB,00000001,00000000,00000002,00000000,00411EBA,?,00000000,00411EFE), ref: 0040C1E7

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 50424b7e63cd685a17b9bd9a31ccaacf5ff4b9d99749838fd5b7a0ea15fdad11
Instruction ID: f9611c5e409b5906aabc26baa8b2dfa3f65e665b165aedc4df9fb55df43993f0
Opcode Fuzzy Hash: 50424b7e63cd685a17b9bd9a31ccaacf5ff4b9d99749838fd5b7a0ea15fdad11
Instruction Fuzzy Hash: 51E092762041009BD610E6ADD8C1AAB77DC9F85374F244737F664EB1D2D675D8008775

Uniqueness

Uniqueness Score: -1.00%

Function 0040C390, Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040C390(intOrPtr* __eax, long __ecx, void* __edx) {
				long _v16;
				int _t7;
				intOrPtr* _t12;

				_push(__ecx);
				_t12 = __eax;
				_t7 = ReadFile( *(__eax + 4), __edx, __ecx,  &_v16, 0); // executed
				if(_t7 == 0 && ( *((char*)(_t12 + 8)) != 0 || GetLastError() != 0x6d)) {
					E0040C1E4( *_t12);
				}
				return _v16;
			}

0x0040c393
0x0040c398
0x0040c3a7
0x0040c3ae
0x0040c3c2
0x0040c3c2
0x0040c3ce

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0040C3A7
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 0040C3B6

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 30cf0fc7fcda4529806b73604fb8d9908d86cd92c6d9eb36858da68b1bf07751
Instruction ID: e0f4121c1e9b4399ab2b1c9bf066f68ed76d1cae12be267a3e8b7d415970813a
Opcode Fuzzy Hash: 30cf0fc7fcda4529806b73604fb8d9908d86cd92c6d9eb36858da68b1bf07751
Instruction Fuzzy Hash: 78E09B72214150EADB10E75A9CC4F5B57DCCB86314F04817BF904DB281C674CC10C775

Uniqueness

Uniqueness Score: -1.00%

Function 0040C328, Relevance: 3.0, APIs: 2, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C328(intOrPtr* __eax, long* __edx) {
				long _t8;
				long* _t11;
				intOrPtr* _t13;

				_t11 = __edx;
				_t13 = __eax;
				 *(__edx + 4) = 0;
				_t8 = SetFilePointer( *(__eax + 4), 0, __edx + 4, 1); // executed
				 *_t11 = _t8;
				if( *_t11 == 0xffffffff) {
					_t8 = GetLastError();
					if(_t8 != 0) {
						return E0040C1E4( *_t13);
					}
				}
				return _t8;
			}

0x0040c32a
0x0040c32c
0x0040c330
0x0040c33f
0x0040c344
0x0040c349
0x0040c34b
0x0040c352
0x00000000
0x0040c356
0x0040c352
0x0040c35d

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 0040C33F
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 0040C34B

Part of subcall function 0040C1E4: GetLastError.KERNEL32(0040C0A4,0040C287,?,?,00000000,?,004118BB,00000001,00000000,00000002,00000000,00411EBA,?,00000000,00411EFE), ref: 0040C1E7

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: b5bc04d13ce7e0f4b6f76b7c9c32d4ca4eee90dc55d430a3763c41653256f821
Instruction ID: 6bb32860de773fec7b433492fb75275ead893e8bd59b77a14ca8c87ab5f49da4
Opcode Fuzzy Hash: b5bc04d13ce7e0f4b6f76b7c9c32d4ca4eee90dc55d430a3763c41653256f821
Instruction Fuzzy Hash: E1E04FB1600210DFEB10EFB588C1B66B6D89F04368F098676EA15DF2C5E675CC00C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0040A2F4, Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A2F4(int __eax, void* __edx) {
				LONG* _t5;
				void* _t8;

				_t2 = __eax;
				if(__edx >= 0) {
					_t8 = __edx + 1;
					_t5 = __eax;
					goto L2;
					do {
						do {
							L2:
						} while (InterlockedCompareExchange(_t5, 1, 0) != 0);
						_t1 =  &(_t5[1]); // 0x0
						_t2 = CloseHandle( *_t1); // executed
						_t5 =  &(_t5[2]);
						_t8 = _t8 - 1;
					} while (_t8 != 0);
				}
				return _t2;
			}

0x0040a2f4
0x0040a2fa
0x0040a2fc
0x0040a2fd
0x0040a2fd
0x0040a2ff
0x0040a2ff
0x0040a2ff
0x0040a309
0x0040a30d
0x0040a311
0x0040a316
0x0040a319
0x0040a319
0x0040a2ff
0x0040a31e

APIs

InterlockedCompareExchange.KERNEL32(00415CA4,00000001,00000000), ref: 0040A304
CloseHandle.KERNEL32(00000000,?,00415DA8,0040A354,00415DA8,00000000,00415DA4,00000000,?,0040B156,00000000,0040B2A9), ref: 0040A311

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCompareExchangeHandleInterlocked
String ID:
API String ID: 190309047-0
Opcode ID: be626e2ef2a55e18661b3a68549b16555cdf0c22c566df155ca2d3d5298791dd
Instruction ID: 4f59e876e8f462647f5b87e6077f489c8bd3fa80aa1a1c9cbd2e5d0525511eb3
Opcode Fuzzy Hash: be626e2ef2a55e18661b3a68549b16555cdf0c22c566df155ca2d3d5298791dd
Instruction Fuzzy Hash: C6D05EB265172023DA202AA91D81B56014C8B54758F0114BBBE01FA3C2E1BA8C6002A8

Uniqueness

Uniqueness Score: -1.00%

Function 0040C42C, Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040C42C(intOrPtr* __eax, long __ecx, void* __edx, void* __ebp) {
				long _v16;
				void* __ebx;
				int _t6;
				intOrPtr* _t9;
				long _t15;

				_push(__ecx);
				_t15 = __ecx;
				_t9 = __eax;
				_t6 = WriteFile( *(__eax + 4), __edx, __ecx,  &_v16, 0); // executed
				if(_t6 == 0) {
					_t6 = E0040C1E4( *_t9);
				}
				if(_t15 != _v16) {
					_t6 = E0040C130(_t9, 0x1d);
				}
				return _t6;
			}

0x0040c42f
0x0040c430
0x0040c434
0x0040c443
0x0040c44a
0x0040c44e
0x0040c44e
0x0040c456
0x0040c45f
0x0040c45f
0x0040c468

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0040C443

Part of subcall function 0040C1E4: GetLastError.KERNEL32(0040C0A4,0040C287,?,?,00000000,?,004118BB,00000001,00000000,00000002,00000000,00411EBA,?,00000000,00411EFE), ref: 0040C1E7

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 3f27af93616d44cafd920d86f12288abf041101562baca60bd8f4dd466a85639
Instruction ID: 5f691bc60c61b380f8ace00ad4bc758de0d67d566e919883e0a27f2df786f2ed
Opcode Fuzzy Hash: 3f27af93616d44cafd920d86f12288abf041101562baca60bd8f4dd466a85639
Instruction Fuzzy Hash: BAE01272704110ABDB10E75ED8C0F67A7DCDF85754F00817BB548DB256D574DC048AB5

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF84, Relevance: 1.5, APIs: 1, Instructions: 28
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BF84(long __eax, void* __edx) {
				short _v2052;
				signed int _t7;
				void* _t10;
				signed int _t16;
				void* _t17;

				_t10 = __edx;
				_t7 = FormatMessageW(0x3200, 0, __eax, 0,  &_v2052, 0x400, 0); // executed
				while(_t7 > 0) {
					_t16 =  *(_t17 + _t7 * 2 - 2) & 0x0000ffff;
					if(_t16 <= 0x20) {
						L1:
						_t7 = _t7 - 1;
						__eflags = _t7;
						continue;
					} else {
						_t20 = _t16 - 0x2e;
						if(_t16 == 0x2e) {
							goto L1;
						}
					}
					break;
				}
				return E00404DD4(_t10, _t7, _t17, _t20);
			}

0x0040bf8b
0x0040bfa3
0x0040bfab
0x0040bfaf
0x0040bfb8
0x0040bfaa
0x0040bfaa
0x0040bfaa
0x00000000
0x0040bfba
0x0040bfba
0x0040bfbe
0x00000000
0x00000000
0x0040bfbe
0x00000000
0x0040bfb8
0x0040bfd1

APIs

FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,0040C156,00000000,0040C1A7,?,0040C360), ref: 0040BFA3

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 78b631aa6f0c220d234d81b028a8f39ac27aaf547ccc31545c27bd411d18f62e
Instruction ID: 54a6effb2ad2d49ab466ee6a75d0bb386577af74ea474ee3005c175c4631f906
Opcode Fuzzy Hash: 78b631aa6f0c220d234d81b028a8f39ac27aaf547ccc31545c27bd411d18f62e
Instruction Fuzzy Hash: F8E0D8A075430316F22911144C03B7B1109CBC0B00FA08436B600EF3D9DBBE985986DE

Uniqueness

Uniqueness Score: -1.00%

Function 0040B698, Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E0040B698(void* __eax, void* __ebx, void* __ecx, void* __eflags) {
				char _v8;
				intOrPtr _t21;
				intOrPtr _t24;

				_push(0);
				_push(_t24);
				_push(0x40b6de);
				_push( *[fs:eax]);
				 *[fs:eax] = _t24;
				E0040B62C(__eax, __ecx,  &_v8, __eflags);
				GetFileAttributesW(E00404D24(_v8)); // executed
				_pop(_t21);
				 *[fs:eax] = _t21;
				_push(E0040B6E5);
				return L00404C88( &_v8);
			}

0x0040b69b
0x0040b6a2
0x0040b6a3
0x0040b6a8
0x0040b6ab
0x0040b6b3
0x0040b6c1
0x0040b6ca
0x0040b6cd
0x0040b6d0
0x0040b6dd

APIs

GetFileAttributesW.KERNEL32(00000000,00000000,0040B6DE,?,?,00000000,?,0040B6F1,0040BA6E,00000000,0040BAB3,?,?,00000000,00000000), ref: 0040B6C1

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4d65c1aa47821c360c71166b3d4a266793d1786de3f7429b732c39a9dcd030f1
Instruction ID: a06aa6656fdad5e9dbbd83ce560a082ed6b537c9876e7170b744a42e3e33ef30
Opcode Fuzzy Hash: 4d65c1aa47821c360c71166b3d4a266793d1786de3f7429b732c39a9dcd030f1
Instruction Fuzzy Hash: B3E09271704308AFE701EB72DD5391DB3ECD789704BA2087AF900F3A81E67A9E00855C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2E0, Relevance: 1.5, APIs: 1, Instructions: 26
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C2E0(signed int __ecx, void* __edx, signed char _a4, signed char _a8) {
				void* _t17;

				_t17 = CreateFileW(E00404D24(__edx),  *(0x4129dc + (_a8 & 0x000000ff) * 4),  *(0x4129e8 + (_a4 & 0x000000ff) * 4), 0,  *(0x4129f8 + (__ecx & 0x000000ff) * 4), 0x80, 0); // executed
				return _t17;
			}

0x0040c31d
0x0040c325

APIs

CreateFileW.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 0040C31D

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 63fc4f49aec430f3829336a694d8165bea7383a72ca2888a76604ad14c713c38
Instruction ID: 13404cbe62acdba55d2813df6ef1882d8c39da72c30555add375271e33042dcc
Opcode Fuzzy Hash: 63fc4f49aec430f3829336a694d8165bea7383a72ca2888a76604ad14c713c38
Instruction Fuzzy Hash: 20E012B134416C2ED240969DAC51FA6779CA719715F008023F994DB281C0A6D9209AE8

Uniqueness

Uniqueness Score: -1.00%

Function 00405B48, Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405B48(void* __eax) {
				short _v532;
				intOrPtr _t14;
				void* _t16;
				intOrPtr _t18;
				WCHAR* _t19;

				_t16 = __eax;
				if( *((intOrPtr*)(__eax + 0x10)) == 0) {
					GetModuleFileNameW( *(__eax + 4),  &_v532, 0x20a);
					_t14 = E00405DE8(_t19); // executed
					_t18 = _t14;
					 *((intOrPtr*)(_t16 + 0x10)) = _t18;
					if(_t18 == 0) {
						 *((intOrPtr*)(_t16 + 0x10)) =  *((intOrPtr*)(_t16 + 4));
					}
				}
				return  *((intOrPtr*)(_t16 + 0x10));
			}

0x00405b50
0x00405b56
0x00405b66
0x00405b6f
0x00405b74
0x00405b76
0x00405b7b
0x00405b80
0x00405b80
0x00405b7b
0x00405b8e

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 00405B66

Part of subcall function 00405DE8: GetModuleFileNameW.KERNEL32(00000000,?,00000105,?,00000000), ref: 00405E04
Part of subcall function 00405DE8: RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,?,00000000), ref: 00405E24
Part of subcall function 00405DE8: RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,?,00000000), ref: 00405E42
Part of subcall function 00405DE8: RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000), ref: 00405E60
Part of subcall function 00405DE8: RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00405E7E
Part of subcall function 00405DE8: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00405F1C,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?), ref: 00405EC7
Part of subcall function 00405DE8: RegQueryValueExW.ADVAPI32(?,00406110,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00405F1C,?,80000001), ref: 00405EE5
Part of subcall function 00405DE8: RegCloseKey.ADVAPI32(?,00405F23,00000000,?,?,00000000,00405F1C,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00405F16

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 8c9758be25788c771a96be9b96f2f469653191ca95e081fd4ab6892ed6ab7e97
Instruction ID: 514b741bebc9be100643021af33e25a7a2a1590cfa8c206c69565e72355c73da
Opcode Fuzzy Hash: 8c9758be25788c771a96be9b96f2f469653191ca95e081fd4ab6892ed6ab7e97
Instruction Fuzzy Hash: DBE0C971A007109FCB14DE58C8C5A5737E4AF08764F044A66AD14EF386D375E9108BD5

Uniqueness

Uniqueness Score: -1.00%

Function 0040C410, Relevance: 1.5, APIs: 1, Instructions: 11
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C410(intOrPtr* __eax) {
				int _t4;
				intOrPtr* _t7;

				_t7 = __eax;
				_t4 = SetEndOfFile( *(__eax + 4)); // executed
				if(_t4 == 0) {
					return E0040C1E4( *_t7);
				}
				return _t4;
			}

0x0040c411
0x0040c417
0x0040c41e
0x00000000
0x0040c422
0x0040c428

APIs

SetEndOfFile.KERNEL32(?,7FD50010,00411C76,00000000), ref: 0040C417

Part of subcall function 0040C1E4: GetLastError.KERNEL32(0040C0A4,0040C287,?,?,00000000,?,004118BB,00000001,00000000,00000002,00000000,00411EBA,?,00000000,00411EFE), ref: 0040C1E7

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: a3404d2f1f053cf2f3e86efe0e478a67ee0e867368918682c51ca0df89d9ab2f
Instruction ID: 6b5fd851a2480aff7a6dd7d3e712bfbbac8f25b2dfd40299735038a0fc5377eb
Opcode Fuzzy Hash: a3404d2f1f053cf2f3e86efe0e478a67ee0e867368918682c51ca0df89d9ab2f
Instruction Fuzzy Hash: C0C04CB1201100C7CB00ABEAD5C191666DC6A483083448176B504DF247D678D8108A25

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACDF, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040ACDF() {
				int _t4;
				intOrPtr _t7;
				void* _t8;

				_pop(_t7);
				 *[fs:eax] = _t7;
				_push(E0040ACFD);
				_t4 = SetErrorMode( *(_t8 - 0xc)); // executed
				return _t4;
			}

0x0040ace1
0x0040ace4
0x0040ace7
0x0040acf0
0x0040acf5

APIs

SetErrorMode.KERNEL32(?,0040ACFD), ref: 0040ACF0

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: fc285dc2b3e37b3a2430b6cb798d4d006232da26ef733131f1ea31aed88b1510
Instruction ID: 112f59639df773ce5e8ef13905132ba6fc2be3043f547875694a47c1d55f0219
Opcode Fuzzy Hash: fc285dc2b3e37b3a2430b6cb798d4d006232da26ef733131f1ea31aed88b1510
Instruction Fuzzy Hash: 1CB09B7764C7405EF705D695A41152863D8D7C47143A2C477F412D65C0D53D55104519

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACFB, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACFB() {
				int _t3;
				void* _t4;

				_t3 = SetErrorMode( *(_t4 - 0xc)); // executed
				return _t3;
			}

0x0040acf0
0x0040acf5

APIs

SetErrorMode.KERNEL32(?,0040ACFD), ref: 0040ACF0

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: e041ad833e26832a7a46faca488033c8bf34126b8d66408357392999026807de
Instruction ID: 0d6ffb28b60556907f55dc5a8f6c8d323e4632824e5f7ee3d30a7447b9079724
Opcode Fuzzy Hash: e041ad833e26832a7a46faca488033c8bf34126b8d66408357392999026807de
Instruction Fuzzy Hash: A5A0222AC0C200B3CE00F2E0800082C232C3A883003C2C8A23002B2080C03E80200A0B

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE24, Relevance: 1.3, APIs: 1, Instructions: 62
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CE24(void* __eax, void* __fp0) {
				char _v16;
				char _v20;
				void* _v28;
				void* _t29;
				void* _t32;
				void* _t40;
				void* _t50;
				long _t52;

				_t40 = __eax;
				if( *((intOrPtr*)(__eax + 8))() != 5) {
					E0040CC3C(1);
				}
				E00403250(_t40 + 0x14, 0x50);
				if(E0040D9D8(_t40 + 0x14, 0x50,  &_v16,  &_v20, 5) != 0) {
					E0040CC3C(3);
				}
				if(_v16 > 0x4000000) {
					E0040CC3C(7);
				}
				_t52 = _v20 + _v16;
				if(_t52 !=  *(_t40 + 0x68)) {
					E0040CDCC(_t40);
					_t32 = VirtualAlloc(0, _t52, 0x1000, 4); // executed
					_t50 = _t32;
					 *(_t40 + 0x64) = _t50;
					if(_t50 == 0) {
						E00409818();
					}
					 *(_t40 + 0x68) = _t52;
				}
				_t29 = E0040DA28(_t40 + 0x14,  *(_t40 + 0x64) + _v20,  *(_t40 + 0x64));
				 *((char*)(_t40 + 0x11)) = 1;
				return _t29;
			}

0x0040ce2a
0x0040ce3c
0x0040ce43
0x0040ce43
0x0040ce52
0x0040ce76
0x0040ce7d
0x0040ce7d
0x0040ce8a
0x0040ce91
0x0040ce91
0x0040ce9a
0x0040cea1
0x0040cea5
0x0040ceb4
0x0040ceb9
0x0040cebb
0x0040cec0
0x0040cec2
0x0040cec2
0x0040cec7
0x0040cec7
0x0040ced7
0x0040cedc
0x0040cee6

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0040CEB4

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 84bc43b6259db1837c568f64c54b97117a3ea5fb393dbdc328f1c683a4eb19c9
Instruction ID: b6681b459df67ccd1e5ce076e039c9ae0ad0e44203837902a123d5042d1e434f
Opcode Fuzzy Hash: 84bc43b6259db1837c568f64c54b97117a3ea5fb393dbdc328f1c683a4eb19c9
Instruction Fuzzy Hash: 31117231604204DBDB10EF59D8C1B5B3798DF84319F00817AF949AB2C6D638D805CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401706, Relevance: 1.3, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00401706(void* __eax) {
				struct _MEMORY_BASIC_INFORMATION _v44;
				void* _v48;
				void* _t13;
				int _t20;
				void* _t22;
				signed int _t26;
				signed int _t29;
				signed int _t30;
				void* _t34;
				intOrPtr _t35;
				signed int _t39;
				void* _t41;
				void* _t42;

				_push(_t29);
				_t42 = _t41 + 0xffffffdc;
				_t34 = __eax - 0x10;
				E0040165C();
				_t13 = _t34;
				 *_t42 =  *_t13;
				_v48 =  *((intOrPtr*)(_t13 + 4));
				_t26 =  *(_t13 + 0xc);
				if((_t26 & 0x00000008) != 0) {
					_t22 = _t34;
					_t39 = _t26 & 0xfffffff0;
					_t30 = 0;
					while(1) {
						VirtualQuery(_t22,  &_v44, 0x1c);
						if(VirtualFree(_t22, 0, 0x8000) == 0) {
							break;
						}
						_t35 = _v44.RegionSize;
						if(_t39 > _t35) {
							_t39 = _t39 - _t35;
							_t22 = _t22 + _t35;
							continue;
						}
						goto L10;
					}
					_t30 = _t30 | 0xffffffff;
				} else {
					_t20 = VirtualFree(_t34, 0, 0x8000); // executed
					if(_t20 == 0) {
						_t30 = _t29 | 0xffffffff;
					} else {
						_t30 = 0;
					}
				}
				L10:
				if(_t30 == 0) {
					 *_v48 =  *_t42;
					 *( *_t42 + 4) = _v48;
				}
				 *0x415ac4 = 0;
				return _t30;
			}

0x0040170a
0x0040170c
0x00401711
0x00401714
0x00401719
0x0040171d
0x00401723
0x00401727
0x0040172d
0x00401749
0x0040174d
0x00401750
0x00401752
0x0040175a
0x0040176e
0x00000000
0x00000000
0x00401775
0x0040177b
0x0040177d
0x0040177f
0x00000000
0x0040177f
0x00000000
0x0040177b
0x00401770
0x0040172f
0x00401737
0x0040173e
0x00401744
0x00401740
0x00401740
0x00401740
0x0040173e
0x00401783
0x00401785
0x0040178e
0x00401797
0x00401797
0x0040179a
0x004017aa

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 00401737
VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040175A
VirtualFree.KERNEL32(?,00000000,00008000,?,?,0000001C), ref: 00401767

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$Free$Query
String ID:
API String ID: 778034434-0
Opcode ID: 1f8cc85d58d84fecc884ae731a3f0fa7b9dad45823223e1fb4daec084ce4bc2b
Instruction ID: b087b523a7cdde792340b118d0caba1a8ecc00495ea843c26d989cfd8e6ee0d2
Opcode Fuzzy Hash: 1f8cc85d58d84fecc884ae731a3f0fa7b9dad45823223e1fb4daec084ce4bc2b
Instruction Fuzzy Hash: D3F069343046009FD310DB2AC984B5BB7E5EFC8760F19C67AE9889B3A1D635DC02979A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2AC, Relevance: 1.3, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C2AC(signed int __edx) {
				void* _t3;
				void* _t4;
				void* _t6;
				signed int _t11;
				void* _t15;

				_t4 = E00403A8C(_t3, __edx);
				_t11 = __edx;
				_t15 = _t4;
				if( *((char*)(_t15 + 8)) != 0) {
					CloseHandle( *(_t15 + 4)); // executed
				}
				_t6 = E00403884(_t11 & 0x000000fc);
				if(_t11 > 0) {
					return E00403A34(_t15);
				}
				return _t6;
			}

0x0040c2ae
0x0040c2b3
0x0040c2b5
0x0040c2bb
0x0040c2c1
0x0040c2c1
0x0040c2cd
0x0040c2d4
0x00000000
0x0040c2d8
0x0040c2df

APIs

CloseHandle.KERNEL32(?), ref: 0040C2C1

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f207754768eb2adbf3d9bba580aefa7a1eecef27c8b5d337bcd18dd9ac0b30e3
Instruction ID: 52e0be0a24c7e9235cb3898ef0266e034d147dd7413e0674b114539fed1210a4
Opcode Fuzzy Hash: f207754768eb2adbf3d9bba580aefa7a1eecef27c8b5d337bcd18dd9ac0b30e3
Instruction Fuzzy Hash: 19D02B42B00A2003C21177FE44C128BA6884F0436AB084A7EB590E72D2D73CCE01439C

Uniqueness

Uniqueness Score: -1.00%

Function 0040CDCC, Relevance: 1.3, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CDCC(void* __eax) {
				void* _t6;
				void* _t9;

				_t9 = __eax;
				 *((intOrPtr*)(__eax + 0x68)) = 0;
				_t6 =  *(__eax + 0x64);
				if(_t6 != 0) {
					VirtualFree(_t6, 0, 0x8000); // executed
					 *((intOrPtr*)(_t9 + 0x64)) = 0;
					return 0;
				}
				return _t6;
			}

0x0040cdcd
0x0040cdd1
0x0040cdd4
0x0040cdd9
0x0040cde3
0x0040cdea
0x00000000
0x0040cdea
0x0040cdee

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,0040CDB2), ref: 0040CDE3

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ff04fd8dcd11e6fbafa61476d2b9ef1a7874464dd62cbe148c55b2defef5a7c5
Instruction ID: d4de7230741a84b6279af0e8d68159cf60326ecd709791186f7f3d6a8192444b
Opcode Fuzzy Hash: ff04fd8dcd11e6fbafa61476d2b9ef1a7874464dd62cbe148c55b2defef5a7c5
Instruction Fuzzy Hash: 83D0E9B17553009BEB90FF794DC1B023BD96F08740F11447A6508EA286E674D454C654

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00405BEC, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 152
stringlibraryfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00405BEC(WCHAR* __eax, int __edx) {
				WCHAR* _v8;
				int _v12;
				WCHAR* _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v612;
				short _v1134;
				signed int _t53;
				signed int _t54;
				signed int _t59;
				signed int _t60;
				signed int _t105;
				signed int _t106;
				intOrPtr* _t107;
				WCHAR* _t114;
				WCHAR* _t116;
				short* _t117;
				void* _t118;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_v20 = GetModuleHandleW(L"kernel32.dll");
				if(_v20 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t116 =  &(_v8[2]);
						goto L10;
					} else {
						if(_v8[1] == 0x5c) {
							_t117 = E00405BC8( &(_v8[2]));
							if( *_t117 != 0) {
								_t17 = _t117 + 2; // 0x2
								_t116 = E00405BC8(_t17);
								if( *_t116 != 0) {
									L10:
									_t105 = _t116 - _v8;
									_t106 = _t105 >> 1;
									if(_t105 < 0) {
										asm("adc ebx, 0x0");
									}
									lstrcpynW( &_v1134, _v8, _t106 + 1);
									while( *_t116 != 0) {
										_t114 = E00405BC8( &(_t116[1]));
										_t53 = _t114 - _t116;
										_t54 = _t53 >> 1;
										if(_t53 < 0) {
											asm("adc eax, 0x0");
										}
										if(_t54 + _t106 + 1 <= 0x105) {
											_t59 = _t114 - _t116;
											_t60 = _t59 >> 1;
											if(_t59 < 0) {
												asm("adc eax, 0x0");
											}
											lstrcpynW( &_v1134 + _t106 + _t106, _t116, _t60 + 1);
											_v20 = FindFirstFileW( &_v1134,  &_v612);
											if(_v20 != 0xffffffff) {
												FindClose(_v20);
												if(lstrlenW( &(_v612.cFileName)) + _t106 + 1 + 1 <= 0x105) {
													 *((short*)(_t118 + _t106 * 2 - 0x46a)) = 0x5c;
													lstrcpynW( &(( &_v1134 + _t106 + _t106)[1]),  &(_v612.cFileName), 0x105 - _t106 - 1);
													_t106 = _t106 + lstrlenW( &(_v612.cFileName)) + 1;
													_t116 = _t114;
													continue;
												}
											}
										}
										goto L23;
									}
									lstrcpynW(_v8,  &_v1134, _v12);
								}
							}
						}
					}
				} else {
					_t107 = GetProcAddress(_v20, "GetLongPathNameW");
					if(_t107 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v1134);
						_push(_v8);
						if( *_t107() == 0) {
							goto L4;
						} else {
							lstrcpynW(_v8,  &_v1134, _v12);
						}
					}
				}
				L23:
				return _v16;
			}

0x00405bf8
0x00405bfb
0x00405c01
0x00405c0e
0x00405c15
0x00405c5a
0x00405c61
0x00405ca1
0x00000000
0x00405c63
0x00405c6b
0x00405c7c
0x00405c82
0x00405c88
0x00405c90
0x00405c96
0x00405ca4
0x00405ca6
0x00405ca9
0x00405cab
0x00405cad
0x00405cad
0x00405cbf
0x00405d8e
0x00405cd1
0x00405cd5
0x00405cd7
0x00405cd9
0x00405cdb
0x00405cdb
0x00405ce6
0x00405cee
0x00405cf0
0x00405cf2
0x00405cf4
0x00405cf4
0x00405d07
0x00405d1f
0x00405d26
0x00405d30
0x00405d4c
0x00405d4e
0x00405d78
0x00405d8a
0x00405d8c
0x00000000
0x00405d8c
0x00405d4c
0x00405d26
0x00000000
0x00405ce6
0x00405da7
0x00405da7
0x00405c96
0x00405c82
0x00405c6b
0x00405c17
0x00405c25
0x00405c29
0x00000000
0x00405c2b
0x00405c2b
0x00405c36
0x00405c3a
0x00405c3f
0x00000000
0x00405c41
0x00405c50
0x00405c50
0x00405c3f
0x00405c29
0x00405dac
0x00405db5

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00407574,?,00000000), ref: 00405C09
GetProcAddress.KERNEL32(?,GetLongPathNameW), ref: 00405C20
lstrcpynW.KERNEL32(?,?,?), ref: 00405C50
lstrcpynW.KERNEL32(?,?,?,kernel32.dll,00407574,?,00000000), ref: 00405CBF
lstrcpynW.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,00407574,?,00000000), ref: 00405D07
FindFirstFileW.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,00407574,?,00000000), ref: 00405D1A
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,00407574,?,00000000), ref: 00405D30
lstrlenW.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,00407574,?,00000000), ref: 00405D3C
lstrcpynW.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,00407574,?), ref: 00405D78
lstrlenW.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,00407574), ref: 00405D84
lstrcpynW.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 00405DA7

Strings

\, xrefs: 00405D4E
kernel32.dll, xrefs: 00405C04
GetLongPathNameW, xrefs: 00405C17

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 3245196872-3908791685
Opcode ID: 1253a85fb23fe974578941fb111989e320402073ff3a7dddb8b82e84d419481d
Instruction ID: c2074287e695d44b88807d81ef8362fcd301c369dd62e3440cf0f4018af864f0
Opcode Fuzzy Hash: 1253a85fb23fe974578941fb111989e320402073ff3a7dddb8b82e84d419481d
Instruction Fuzzy Hash: DB515071A006199BDB10DAA9CC89ADF73BCEF48310F1445B7A604F7291E778AE408F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040E550, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040E550() {
				int _v4;
				struct _TOKEN_PRIVILEGES _v16;
				void* _v20;
				intOrPtr* _t6;
				int _t7;

				_t6 =  *0x412c80; // 0x4127d8
				if( *_t6 != 2) {
					L5:
					_t7 = ExitWindowsEx(2, 0);
					asm("sbb eax, eax");
					return _t7 + 1;
				}
				if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v20) != 0) {
					LookupPrivilegeValueW(0, L"SeShutdownPrivilege",  &(_v16.Privileges));
					_v16.PrivilegeCount = 1;
					_v4 = 2;
					AdjustTokenPrivileges(_v20, 0,  &_v16, 0, 0, 0);
					if(GetLastError() == 0) {
						goto L5;
					}
					return 0;
				}
				return 0;
			}

0x0040e553
0x0040e55b
0x0040e5b8
0x0040e5bc
0x0040e5c4
0x00000000
0x0040e5c6
0x0040e56d
0x0040e57f
0x0040e584
0x0040e58c
0x0040e5a6
0x0040e5b2
0x00000000
0x00000000
0x00000000
0x0040e5b4
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0040E560
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040E566
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 0040E57F
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 0040E5A6
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 0040E5AB
ExitWindowsEx.USER32(00000002,00000000), ref: 0040E5BC

Strings

SeShutdownPrivilege, xrefs: 0040E578

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 25d3368c1ed5e23635777c4d7c7eb55980692210548a868ee2fafaaa75d72c6d
Instruction ID: 195d351e3660a938a6d40f549d35ed53c17078d6e2ed3d4d02f69e25cd50e083
Opcode Fuzzy Hash: 25d3368c1ed5e23635777c4d7c7eb55980692210548a868ee2fafaaa75d72c6d
Instruction Fuzzy Hash: F9F04F70694302BAF610AAA78C03F6F65C85B40B1CF504C3AF642FA1D1F7BDD524866E

Uniqueness

Uniqueness Score: -1.00%

Function 0040EE2C, Relevance: 6.0, APIs: 4, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EE2C() {
				struct HRSRC__* _t10;
				void* _t11;
				void* _t12;

				_t10 = FindResourceW(0, 0x2b67, 0xa);
				if(_t10 == 0) {
					E0040EC70();
				}
				if(SizeofResource(0, _t10) != 0x2c) {
					E0040EC70();
				}
				_t11 = LoadResource(0, _t10);
				if(_t11 == 0) {
					E0040EC70();
				}
				_t12 = LockResource(_t11);
				if(_t12 == 0) {
					E0040EC70();
				}
				return _t12;
			}

0x0040ee3b
0x0040ee3f
0x0040ee41
0x0040ee41
0x0040ee51
0x0040ee53
0x0040ee53
0x0040ee60
0x0040ee64
0x0040ee66
0x0040ee66
0x0040ee71
0x0040ee75
0x0040ee77
0x0040ee77
0x0040ee7f

APIs

FindResourceW.KERNEL32(00000000,00002B67,0000000A,?,004118D3,00000000,00411E66,?,00000001,00000000,00000002,00000000,00411EBA,?,00000000,00411EFE), ref: 0040EE36
SizeofResource.KERNEL32(00000000,00000000,00000000,00002B67,0000000A,?,004118D3,00000000,00411E66,?,00000001,00000000,00000002,00000000,00411EBA), ref: 0040EE49
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00002B67,0000000A,?,004118D3,00000000,00411E66,?,00000001,00000000,00000002,00000000), ref: 0040EE5B
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00002B67,0000000A,?,004118D3,00000000,00411E66,?,00000001,00000000,00000002), ref: 0040EE6C

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: e283caba4b26ab8e307a165275339cb6922c576e840aae79e7987a39c20ec004
Instruction ID: 6c0ab9ca5f0d8946521694873587211a18ecb457b9e3ad18f450fa3cfc8e691c
Opcode Fuzzy Hash: e283caba4b26ab8e307a165275339cb6922c576e840aae79e7987a39c20ec004
Instruction Fuzzy Hash: 3AE0759534970625F62136F748CBF2A40484B2A74DF010C3BB641792C2DEBDDC64426E

Uniqueness

Uniqueness Score: -1.00%

Function 0040805C, Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040805C(intOrPtr* __eax, void* __ebx, intOrPtr* __edx, WCHAR* _a8, intOrPtr* _a12) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				short _v24;
				signed int _v28;
				intOrPtr _v117;
				intOrPtr* _t28;
				WCHAR* _t29;
				int _t30;
				short _t35;
				intOrPtr _t38;
				WCHAR* _t43;
				intOrPtr* _t44;
				short _t53;
				short _t55;

				_t28 = __eax +  *__eax;
				 *_t28 =  *_t28 + _t28;
				 *__edx =  *__edx + __ebx;
				 *_t28 =  *_t28 + _t28;
				 *_t28 =  *_t28 + _t28;
				_v117 = _v117 + __edx;
				_push(__ebx);
				_t29 = _a8;
				if(_t29 == 0) {
					_t29 = 0;
				}
				_t30 = GetDiskFreeSpaceW(_t29,  &_v8,  &_v12,  &_v16,  &_v20);
				_v28 = _v8 * _v12;
				_v24 = 0;
				_t53 = _v24;
				_t35 = E004058EC(_v28, _t53, _v16, 0);
				_t43 = _a8;
				 *_t43 = _t35;
				_t43[2] = _t53;
				_t55 = _v24;
				_t38 = E004058EC(_v28, _t55, _v20, 0);
				_t44 = _a12;
				 *_t44 = _t38;
				 *(_t44 + 4) = _t55;
				return _t30;
			}

0x0040805c
0x0040805e
0x00408061
0x00408063
0x00408065
0x00408067
0x0040806e
0x0040806f
0x00408074
0x00408076
0x00408076
0x00408089
0x00408098
0x0040809b
0x004080a8
0x004080ab
0x004080b0
0x004080b3
0x004080b5
0x004080c2
0x004080c5
0x004080ca
0x004080cd
0x004080cf
0x004080d8

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 00408089

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 1b7c22238b0c46b284b2b107f6e5e28a964c48cdf51e692455e1591c4b1c28f1
Instruction ID: a068575fb17e70d0eb2dd941d71b6181fb06f7ad23ffcb3780b10a2596b4250a
Opcode Fuzzy Hash: 1b7c22238b0c46b284b2b107f6e5e28a964c48cdf51e692455e1591c4b1c28f1
Instruction Fuzzy Hash: C01112B5E05249AFCB01DFA9C8818EFBBF5EF89300B14C5AAE405EB251D6315E05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00408EB4, Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00408EB4(int __eax, void* __ecx, int __edx, intOrPtr _a4) {
				short _v516;
				int _t5;
				intOrPtr _t10;
				void* _t18;

				_t18 = __ecx;
				_t10 = _a4;
				_t5 = GetLocaleInfoW(__eax, __edx,  &_v516, 0x100);
				_t19 = _t5;
				if(_t5 <= 0) {
					return E00404C98(_t10, _t18);
				}
				return E00404DD4(_t10, _t5 - 1,  &_v516, _t19);
			}

0x00408ebf
0x00408ec1
0x00408ed2
0x00408ed7
0x00408ed9
0x00000000
0x00408ef1
0x00000000

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00408ED2

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: be8708cd1a96b3c3fec937ad052e44757169f4b75c0fd40938a9157a598839b2
Instruction ID: efd930654affab819bb145c5b770efe1d407367608a80b1910e27d3113095914
Opcode Fuzzy Hash: be8708cd1a96b3c3fec937ad052e44757169f4b75c0fd40938a9157a598839b2
Instruction Fuzzy Hash: B5E0927170021857E714A5998D869E7725C9B88300F00017FBA05E7383ED759D5043E9

Uniqueness

Uniqueness Score: -1.00%

Function 00408F00, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00408F00(int __eax, signed int __ecx, int __edx) {
				short _v16;
				signed int _t5;
				signed int _t10;

				_push(__ecx);
				_t10 = __ecx;
				if(GetLocaleInfoW(__eax, __edx,  &_v16, 2) <= 0) {
					_t5 = _t10;
				} else {
					_t5 = _v16 & 0x0000ffff;
				}
				return _t5;
			}

0x00408f03
0x00408f04
0x00408f1a
0x00408f22
0x00408f1c
0x00408f1c
0x00408f1c
0x00408f28

APIs

GetLocaleInfoW.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040A65C,00000000,0040A886,?,?,00000000,00000000), ref: 00408F13

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f42e9842f151eb554194ec21cabbb46f5fa814863601f6aada20c46152aec99c
Instruction ID: c1a5af872d8d8e0d8faaa3b155c0f045d42fbc39b27c6cde3df4525be18a7e6a
Opcode Fuzzy Hash: f42e9842f151eb554194ec21cabbb46f5fa814863601f6aada20c46152aec99c
Instruction Fuzzy Hash: 20D0A7B630922076E620916B7E45D7766DDCBC4772F10443FBA89D7281D674CC05D379

Uniqueness

Uniqueness Score: -1.00%

Function 0040E658, Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E658(signed int __eax) {
				short _v8;
				signed int _t6;

				_t6 = GetLocaleInfoW(__eax & 0x0000ffff, 0x20001004,  &_v8, 2);
				if(_t6 <= 0) {
					return _t6 | 0xffffffff;
				}
				return _v8;
			}

0x0040e66e
0x0040e675
0x00000000
0x0040e67c
0x00000000

APIs

GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,0040E757), ref: 0040E66E

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e5828f4304d5e20d256d7d996427b8d6e5ffa7e8cf991b9269315e98a5eba594
Instruction ID: 6850f86e2627a72f147c85015730e5669d4f85a9a224221a202e87a2c8c22ffa
Opcode Fuzzy Hash: e5828f4304d5e20d256d7d996427b8d6e5ffa7e8cf991b9269315e98a5eba594
Instruction Fuzzy Hash: A4D05BA1504208BDF90081DA6D42E7672DC9714324F500A26F654D61C1D576EE105229

Uniqueness

Uniqueness Score: -1.00%

Function 0041259C, Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

&A, xrefs: 004126D0

Memory Dump Source

Source File: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: &A
API String ID: 0-2212290781
Opcode ID: f87c336d074ccd6b25351e5a9bdc7e0cc64f501820a8c5d327b4ea150c77c86e
Instruction ID: 1166d917c6c5cb4a1a38ed751bfff6e245ff910a87df84bc7991d532d979c58a
Opcode Fuzzy Hash: f87c336d074ccd6b25351e5a9bdc7e0cc64f501820a8c5d327b4ea150c77c86e
Instruction Fuzzy Hash: 5A51BC6244E3C19FD3274B3489651957FB0AE6B22476A02CFC4C5CF4B3DA6E099AC726

Uniqueness

Uniqueness Score: -1.00%

Function 0040D33C, Relevance: .5, Instructions: 545
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040D33C(intOrPtr* __eax, intOrPtr __ecx, intOrPtr __edx, intOrPtr* _a4, intOrPtr _a8) {
				intOrPtr* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				char _v25;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				char _v64;
				char* _v68;
				void* _v72;
				char _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				signed int _v88;
				char _v89;
				char _v96;
				signed int _v100;
				signed int _v104;
				short* _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				char _v136;
				signed int _t370;
				void* _t375;
				signed int _t377;
				signed int _t381;
				signed int _t389;
				signed int _t395;
				signed int _t411;
				intOrPtr _t422;
				signed int _t426;
				signed int _t435;
				void* _t448;
				signed int _t458;
				char _t460;
				signed int _t474;
				char* _t503;
				signed int _t508;
				signed int _t616;
				signed int _t617;
				signed int _t618;
				signed int _t622;

				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v20 =  *((intOrPtr*)(_v8 + 0x10));
				_v24 = 0;
				_v32 = (1 <<  *(_v8 + 8)) - 1;
				_v36 = (1 <<  *(_v8 + 4)) - 1;
				_v40 =  *_v8;
				_t617 =  *((intOrPtr*)(_v8 + 0x34));
				_t474 =  *(_v8 + 0x44);
				_v44 =  *((intOrPtr*)(_v8 + 0x38));
				_v48 =  *((intOrPtr*)(_v8 + 0x3c));
				_v52 =  *((intOrPtr*)(_v8 + 0x40));
				_v56 =  *((intOrPtr*)(_v8 + 0x48));
				_v60 =  *((intOrPtr*)(_v8 + 0x2c));
				_v64 =  *((intOrPtr*)(_v8 + 0x30));
				_v68 =  *((intOrPtr*)(_v8 + 0x1c));
				_v72 =  *((intOrPtr*)(_v8 + 0xc));
				_t616 =  *((intOrPtr*)(_v8 + 0x28));
				_v128 =  *((intOrPtr*)(_v8 + 0x20));
				_v124 =  *((intOrPtr*)(_v8 + 0x24));
				_v120 = _v12;
				_v136 =  *((intOrPtr*)(_v8 + 0x14));
				_v132 =  *((intOrPtr*)(_v8 + 0x18));
				 *_a4 = 0;
				if(_v56 == 0xffffffff) {
					return 0;
				}
				__eflags = _v72;
				if(_v72 == 0) {
					_v68 =  &_v76;
					_v72 = 1;
					_v76 =  *((intOrPtr*)(_v8 + 0x4c));
				}
				__eflags = _v56 - 0xfffffffe;
				if(_v56 != 0xfffffffe) {
					L12:
					_v108 = _v16 + _v24;
					while(1) {
						__eflags = _v56;
						if(_v56 == 0) {
							break;
						}
						__eflags = _v24 - _a8;
						if(_v24 < _a8) {
							_t458 = _t616 - _t617;
							__eflags = _t458 - _v72;
							if(_t458 >= _v72) {
								_t458 = _t458 + _v72;
								__eflags = _t458;
							}
							_t460 =  *((intOrPtr*)(_v68 + _t458));
							 *((char*)(_v68 + _t616)) = _t460;
							 *_v108 = _t460;
							_v24 = _v24 + 1;
							_v108 = _v108 + 1;
							_t616 = _t616 + 1;
							__eflags = _t616 - _v72;
							if(_t616 == _v72) {
								_t616 = 0;
								__eflags = 0;
							}
							_t116 =  &_v56;
							 *_t116 = _v56 - 1;
							__eflags =  *_t116;
							continue;
						}
						break;
					}
					__eflags = _t616;
					if(_t616 != 0) {
						_v25 =  *((intOrPtr*)(_v68 + _t616 - 1));
					} else {
						_v25 =  *((intOrPtr*)(_v68 + _v72 - 1));
					}
					__eflags = 0;
					_v116 = 0;
					_v112 = 0;
					while(1) {
						L24:
						_v108 = _v16 + _v24;
						__eflags = _v24 - _a8;
						if(_v24 >= _a8) {
							break;
						} else {
							goto L25;
						}
						while(1) {
							L25:
							_v88 = _v24 + _v60 & _v32;
							__eflags = _v116;
							if(_v116 != 0) {
								break;
							}
							__eflags = _v112;
							if(_v112 == 0) {
								_t370 = E0040D094((_t474 << 4) + (_t474 << 4) + _v20 + _v88 + _v88,  &_v136);
								__eflags = _t370;
								if(_t370 != 0) {
									_t375 = E0040D094(_t474 + _t474 + _v20 + 0x180,  &_v136);
									__eflags = _t375 != 1;
									if(_t375 != 1) {
										_v52 = _v48;
										_v48 = _v44;
										_v44 = _t617;
										__eflags = _t474 - 7;
										if(__eflags >= 0) {
											_t377 = 0xa;
										} else {
											_t377 = 7;
										}
										_t474 = _t377;
										_v56 = E0040D244(_v20 + 0x664, _v88,  &_v136, __eflags);
										_t503 =  &_v136;
										__eflags = _v56 - 4;
										if(_v56 >= 4) {
											_t381 = 3;
										} else {
											_t381 = _v56;
										}
										_v100 = E0040D11C((_t381 << 6) + (_t381 << 6) + _v20 + 0x360, _t503, 6);
										__eflags = _v100 - 4;
										if(_v100 < 4) {
											_t618 = _v100;
										} else {
											_v104 = (_v100 >> 1) - 1;
											_t524 = _v104;
											_t622 = (_v100 & 0x00000001 | 0x00000002) << _v104;
											__eflags = _v100 - 0xe;
											if(_v100 >= 0xe) {
												_t395 = E0040D034( &_v136, _t524, _v104 + 0xfffffffc);
												_t618 = _t622 + (_t395 << 4) + E0040D160(_v20 + 0x644,  &_v136, 4);
											} else {
												_t618 = _t622 + E0040D160(_t622 + _t622 + _v20 + 0x560 - _v100 + _v100 + 0xfffffffe,  &_v136, _v104);
											}
										}
										_t617 = _t618 + 1;
										__eflags = _t617;
										if(_t617 != 0) {
											L82:
											_v56 = _v56 + 2;
											__eflags = _t617 - _v64;
											if(_t617 <= _v64) {
												__eflags = _v72 - _v64 - _v56;
												if(_v72 - _v64 <= _v56) {
													_v64 = _v72;
												} else {
													_v64 = _v64 + _v56;
												}
												while(1) {
													_t389 = _t616 - _t617;
													__eflags = _t389 - _v72;
													if(_t389 >= _v72) {
														_t389 = _t389 + _v72;
														__eflags = _t389;
													}
													_v25 =  *((intOrPtr*)(_v68 + _t389));
													 *((char*)(_v68 + _t616)) = _v25;
													_t616 = _t616 + 1;
													__eflags = _t616 - _v72;
													if(_t616 == _v72) {
														_t616 = 0;
														__eflags = 0;
													}
													_v56 = _v56 - 1;
													 *_v108 = _v25;
													_v24 = _v24 + 1;
													_v108 = _v108 + 1;
													__eflags = _v56;
													if(_v56 == 0) {
														break;
													}
													__eflags = _v24 - _a8;
													if(_v24 < _a8) {
														continue;
													}
													break;
												}
												L93:
												__eflags = _v24 - _a8;
												if(_v24 < _a8) {
													continue;
												}
												goto L94;
											}
											return 1;
										} else {
											_v56 = 0xffffffff;
											goto L94;
										}
									}
									_t411 = E0040D094(_t474 + _t474 + _v20 + 0x198,  &_v136);
									__eflags = _t411;
									if(_t411 != 0) {
										__eflags = E0040D094(_t474 + _t474 + _v20 + 0x1b0,  &_v136);
										if(__eflags != 0) {
											__eflags = E0040D094(_t474 + _t474 + _v20 + 0x1c8,  &_v136);
											if(__eflags != 0) {
												_t422 = _v52;
												_v52 = _v48;
											} else {
												_t422 = _v48;
											}
											_v48 = _v44;
										} else {
											_t422 = _v44;
										}
										_v44 = _t617;
										_t617 = _t422;
										L65:
										_v56 = E0040D244(_v20 + 0xa68, _v88,  &_v136, __eflags);
										__eflags = _t474 - 7;
										if(_t474 >= 7) {
											_t426 = 0xb;
										} else {
											_t426 = 8;
										}
										_t474 = _t426;
										goto L82;
									}
									__eflags = E0040D094((_t474 << 4) + (_t474 << 4) + _v20 + _v88 + _v88 + 0x1e0,  &_v136);
									if(__eflags != 0) {
										goto L65;
									}
									__eflags = _v64;
									if(_v64 != 0) {
										__eflags = _t474 - 7;
										if(_t474 >= 7) {
											_t508 = 0xb;
										} else {
											_t508 = 9;
										}
										_t474 = _t508;
										_t435 = _t616 - _t617;
										__eflags = _t435 - _v72;
										if(_t435 >= _v72) {
											_t435 = _t435 + _v72;
											__eflags = _t435;
										}
										_v25 =  *((intOrPtr*)(_v68 + _t435));
										 *((char*)(_v68 + _t616)) = _v25;
										_t616 = _t616 + 1;
										__eflags = _t616 - _v72;
										if(_t616 == _v72) {
											_t616 = 0;
											__eflags = 0;
										}
										 *_v108 = _v25;
										_v24 = _v24 + 1;
										__eflags = _v64 - _v72;
										if(_v64 < _v72) {
											_v64 = _v64 + 1;
										}
										goto L24;
									}
									return 1;
								}
								_t448 = (((_v24 + _v60 & _v36) << _v40) + (0 >> 8 - _v40) << 8) + (((_v24 + _v60 & _v36) << _v40) + (0 >> 8 - _v40) << 8) * 2 + (((_v24 + _v60 & _v36) << _v40) + (0 >> 8 - _v40) << 8) + (((_v24 + _v60 & _v36) << _v40) + (0 >> 8 - _v40) << 8) * 2 + _v20 + 0xe6c;
								__eflags = _t474 - 7;
								if(__eflags < 0) {
									_v25 = E0040D1A4(_t448,  &_v136, __eflags);
								} else {
									_v96 = _t616 - _t617;
									__eflags = _v96 - _v72;
									if(__eflags >= 0) {
										_t161 =  &_v96;
										 *_t161 = _v96 + _v72;
										__eflags =  *_t161;
									}
									_v89 =  *((intOrPtr*)(_v68 + _v96));
									_v25 = E0040D1D0(_t448, _v89,  &_v136, __eflags);
								}
								 *_v108 = _v25;
								_v24 = _v24 + 1;
								_v108 = _v108 + 1;
								__eflags = _v64 - _v72;
								if(_v64 < _v72) {
									_t180 =  &_v64;
									 *_t180 = _v64 + 1;
									__eflags =  *_t180;
								}
								 *((char*)(_v68 + _t616)) = _v25;
								_t616 = _t616 + 1;
								__eflags = _t616 - _v72;
								if(_t616 == _v72) {
									_t616 = 0;
									__eflags = 0;
								}
								__eflags = _t474 - 4;
								if(_t474 >= 4) {
									__eflags = _t474 - 0xa;
									if(_t474 >= 0xa) {
										_t474 = _t474 - 6;
									} else {
										_t474 = _t474 - 3;
									}
								} else {
									_t474 = 0;
								}
								goto L93;
							}
							return 1;
						}
						return _v116;
					}
					L94:
					 *((intOrPtr*)(_v8 + 0x20)) = _v128;
					 *((intOrPtr*)(_v8 + 0x24)) = _v124;
					 *((intOrPtr*)(_v8 + 0x28)) = _t616;
					 *((intOrPtr*)(_v8 + 0x2c)) = _v60 + _v24;
					 *((intOrPtr*)(_v8 + 0x30)) = _v64;
					 *((intOrPtr*)(_v8 + 0x34)) = _t617;
					 *((intOrPtr*)(_v8 + 0x38)) = _v44;
					 *((intOrPtr*)(_v8 + 0x3c)) = _v48;
					 *((intOrPtr*)(_v8 + 0x40)) = _v52;
					 *(_v8 + 0x44) = _t474;
					 *((intOrPtr*)(_v8 + 0x48)) = _v56;
					 *((char*)(_v8 + 0x4c)) = _v76;
					 *((intOrPtr*)(_v8 + 0x14)) = _v136;
					 *((intOrPtr*)(_v8 + 0x18)) = _v132;
					 *_a4 = _v24;
					__eflags = 0;
					return 0;
				}
				_v80 = (0x300 <<  *(_v8 + 4) + _v40) + 0x736;
				_v84 = 0;
				_v108 = _v20;
				__eflags = _v84 - _v80;
				if(_v84 >= _v80) {
					L7:
					_v52 = 1;
					_v48 = 1;
					_v44 = 1;
					_t617 = 1;
					_v60 = 0;
					_v64 = 0;
					_t474 = 0;
					_t616 = 0;
					 *((char*)(_v68 + _v72 - 1)) = 0;
					E0040CFF4( &_v136);
					__eflags = _v116;
					if(_v116 != 0) {
						return _v116;
					}
					__eflags = _v112;
					if(_v112 == 0) {
						__eflags = 0;
						_v56 = 0;
						goto L12;
					} else {
						return 1;
					}
				} else {
					goto L6;
				}
				do {
					L6:
					 *_v108 = 0x400;
					_v84 = _v84 + 1;
					_v108 = _v108 + 2;
					__eflags = _v84 - _v80;
				} while (_v84 < _v80);
				goto L7;
			}

0x0040d348
0x0040d34b
0x0040d34e
0x0040d359
0x0040d35c
0x0040d36d
0x0040d37e
0x0040d386
0x0040d38f
0x0040d395
0x0040d39b
0x0040d3a4
0x0040d3ad
0x0040d3b6
0x0040d3bf
0x0040d3c8
0x0040d3d1
0x0040d3da
0x0040d3e3
0x0040d3e9
0x0040d3f2
0x0040d3f8
0x0040d401
0x0040d40f
0x0040d415
0x0040d41b
0x00000000
0x0040d41d
0x0040d424
0x0040d428
0x0040d42d
0x0040d430
0x0040d43d
0x0040d43d
0x0040d440
0x0040d444
0x0040d4e5
0x0040d4ee
0x0040d523
0x0040d523
0x0040d527
0x00000000
0x00000000
0x0040d52c
0x0040d52f
0x0040d4f5
0x0040d4f7
0x0040d4fa
0x0040d4fc
0x0040d4fc
0x0040d4fc
0x0040d509
0x0040d50a
0x0040d510
0x0040d512
0x0040d515
0x0040d518
0x0040d519
0x0040d51c
0x0040d51e
0x0040d51e
0x0040d51e
0x0040d520
0x0040d520
0x0040d520
0x00000000
0x0040d520
0x00000000
0x0040d52f
0x0040d531
0x0040d533
0x0040d54b
0x0040d535
0x0040d53f
0x0040d53f
0x0040d550
0x0040d552
0x0040d555
0x0040d558
0x0040d558
0x0040d561
0x0040d567
0x0040d56a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040d570
0x0040d570
0x0040d579
0x0040d57c
0x0040d580
0x00000000
0x00000000
0x0040d58a
0x0040d58e
0x0040d5b1
0x0040d5b6
0x0040d5b8
0x0040d691
0x0040d696
0x0040d697
0x0040d7d7
0x0040d7dd
0x0040d7e0
0x0040d7e3
0x0040d7e6
0x0040d7ef
0x0040d7e8
0x0040d7e8
0x0040d7e8
0x0040d7f4
0x0040d80c
0x0040d80f
0x0040d815
0x0040d819
0x0040d820
0x0040d81b
0x0040d81b
0x0040d81b
0x0040d83c
0x0040d83f
0x0040d843
0x0040d8bc
0x0040d845
0x0040d84b
0x0040d84e
0x0040d85a
0x0040d85c
0x0040d860
0x0040d896
0x0040d8b8
0x0040d862
0x0040d886
0x0040d886
0x0040d860
0x0040d8bf
0x0040d8bf
0x0040d8c0
0x0040d8cb
0x0040d8cb
0x0040d8cf
0x0040d8d2
0x0040d8e4
0x0040d8e7
0x0040d8f4
0x0040d8e9
0x0040d8ec
0x0040d8ec
0x0040d8f7
0x0040d8f9
0x0040d8fb
0x0040d8fe
0x0040d900
0x0040d900
0x0040d900
0x0040d909
0x0040d912
0x0040d915
0x0040d916
0x0040d919
0x0040d91b
0x0040d91b
0x0040d91b
0x0040d91d
0x0040d926
0x0040d928
0x0040d92b
0x0040d92e
0x0040d932
0x00000000
0x00000000
0x0040d937
0x0040d93a
0x00000000
0x00000000
0x00000000
0x0040d93a
0x0040d93c
0x0040d93f
0x0040d942
0x00000000
0x00000000
0x00000000
0x0040d942
0x00000000
0x0040d8c2
0x0040d8c2
0x00000000
0x0040d8c2
0x0040d8c0
0x0040d6af
0x0040d6b4
0x0040d6b6
0x0040d766
0x0040d768
0x0040d786
0x0040d788
0x0040d78f
0x0040d795
0x0040d78a
0x0040d78a
0x0040d78a
0x0040d79b
0x0040d76a
0x0040d76a
0x0040d76a
0x0040d79e
0x0040d7a1
0x0040d7a3
0x0040d7b9
0x0040d7bc
0x0040d7bf
0x0040d7c8
0x0040d7c1
0x0040d7c1
0x0040d7c1
0x0040d7cd
0x00000000
0x0040d7cd
0x0040d6dd
0x0040d6df
0x00000000
0x00000000
0x0040d6e5
0x0040d6e9
0x0040d6f5
0x0040d6f8
0x0040d701
0x0040d6fa
0x0040d6fa
0x0040d6fa
0x0040d706
0x0040d70a
0x0040d70c
0x0040d70f
0x0040d711
0x0040d711
0x0040d711
0x0040d71a
0x0040d723
0x0040d726
0x0040d727
0x0040d72a
0x0040d72c
0x0040d72c
0x0040d72c
0x0040d734
0x0040d736
0x0040d73c
0x0040d73f
0x0040d745
0x0040d745
0x00000000
0x0040d73f
0x00000000
0x0040d6eb
0x0040d5e8
0x0040d5ed
0x0040d5f0
0x0040d631
0x0040d5f2
0x0040d5f6
0x0040d5fc
0x0040d5ff
0x0040d604
0x0040d604
0x0040d604
0x0040d604
0x0040d610
0x0040d621
0x0040d621
0x0040d63a
0x0040d63c
0x0040d63f
0x0040d645
0x0040d648
0x0040d64a
0x0040d64a
0x0040d64a
0x0040d64a
0x0040d653
0x0040d656
0x0040d657
0x0040d65a
0x0040d65c
0x0040d65c
0x0040d65c
0x0040d65e
0x0040d661
0x0040d66a
0x0040d66d
0x0040d677
0x0040d66f
0x0040d66f
0x0040d66f
0x0040d663
0x0040d663
0x0040d663
0x00000000
0x0040d661
0x00000000
0x0040d590
0x00000000
0x0040d582
0x0040d948
0x0040d94e
0x0040d957
0x0040d95d
0x0040d969
0x0040d972
0x0040d978
0x0040d981
0x0040d98a
0x0040d993
0x0040d999
0x0040d9a2
0x0040d9ab
0x0040d9b7
0x0040d9c0
0x0040d9c9
0x0040d9cb
0x00000000
0x0040d9cb
0x0040d461
0x0040d464
0x0040d46c
0x0040d472
0x0040d475
0x0040d48e
0x0040d495
0x0040d498
0x0040d49b
0x0040d49e
0x0040d4a0
0x0040d4a5
0x0040d4a8
0x0040d4b0
0x0040d4b2
0x0040d4bd
0x0040d4c2
0x0040d4c6
0x00000000
0x0040d4c8
0x0040d4d0
0x0040d4d4
0x0040d4e0
0x0040d4e2
0x00000000
0x0040d4d6
0x00000000
0x0040d4d6
0x00000000
0x00000000
0x00000000
0x0040d477
0x0040d477
0x0040d47a
0x0040d47f
0x0040d482
0x0040d489
0x0040d489
0x00000000

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: a068efe37126c024b14c2b8cc3b836a628f8053012d03d8a2c3558ca0f700bcf
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: 2532D375E00219DFCB14CFD9C980AADBBB2BF88314F24816AD815BB395D734AE46CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00402260, Relevance: .1, Instructions: 94
COMMONCrypto

Download Yara Rule

C-Code - Quality: 51%

			E00402260(void* __eax, char* __edx) {
				char* _t103;

				_t103 = __edx;
				_t39 = __eax + 1;
				 *__edx = 0xffffffff89705f71;
				asm("sbb edi, 0xffffffff");
				 *__edx = 0xbadbbd;
				asm("sbb edi, 0xffffffff");
				 *__edx = 0xbadbbd;
				asm("sbb edi, 0xffffffff");
				 *__edx = 0xbadbbd;
				asm("sbb edi, 0xffffffff");
				 *__edx = 0xbadbbd;
				asm("sbb edi, 0xffffffff");
				 *__edx = 0xbadbbd;
				asm("sbb edi, 0xffffffff");
				 *__edx = 0xbadbbd;
				asm("sbb edi, 0xffffffff");
				 *__edx = 0xbadbbd;
				asm("sbb edi, 0xffffffff");
				 *__edx = 0xbadbbd;
				asm("sbb edi, 0xffffffff");
				 *__edx = ((((((((((__eax + 0x00000001) * 0x89705f41 >> 0x00000020 & 0x1fffffff) + 0xfffffffe25c17d04 + (_t39 * 0x89705f41 >> 0x0000001e) & 0x0fffffff) + 0xfffffffe25c17d04 & 0x07ffffff) + 0xfffffffe25c17d04 & 0x03ffffff) + 0xfffffffe25c17d04 & 0x01ffffff) + 0xfffffffe25c17d04 & 0x00ffffff) + 0xfffffffe25c17d04 & 0x007fffff) + 0xfffffffe25c17d04 & 0x003fffff) + 0xfffffffe25c17d04 & 0x001fffff) + 0xfffffffe25c17d04 >> 0x00000014 | 0x00000030;
				_t37 = _t103 + 1; // 0x1
				return _t37;
			}

0x00402261
0x00402263
0x00402285
0x0040228c
0x0040229d
0x004022a8
0x004022b9
0x004022c4
0x004022d5
0x004022e0
0x004022f1
0x004022fc
0x0040230d
0x00402318
0x00402329
0x00402334
0x00402345
0x00402350
0x00402361
0x00402369
0x00402372
0x00402374
0x00402378

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Uniqueness

Uniqueness Score: -1.00%

Function 004122AF, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09136615bbd66392297a2eb1860b1273542cac895542d5bd67ef59a9dbc02e8
Instruction ID: 66ba412eeae15dc307f5bd132cc0ad33d8423d2fffa6849a4d777a3c926dbda3
Opcode Fuzzy Hash: e09136615bbd66392297a2eb1860b1273542cac895542d5bd67ef59a9dbc02e8
Instruction Fuzzy Hash: E731B2A294E3C14FDB034B7489A91817FB0AD1B12835E45EBC4C2CF4A7E15D494BCB26

Uniqueness

Uniqueness Score: -1.00%

Function 004096AC, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E004096AC(long __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				char* _v8;
				long _v12;
				short _v140;
				short _v2188;
				void* _t16;
				char* _t18;
				intOrPtr _t20;
				intOrPtr _t22;
				intOrPtr _t31;
				intOrPtr _t55;
				intOrPtr _t56;
				int _t60;
				void* _t63;

				_push(__ebx);
				_push(__esi);
				_v8 = 0;
				_push(_t63);
				_push(0x4097d1);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t63 + 0xfffff778;
				_t60 = E004094C0(_t16, __ebx,  &_v2188, __edx, __edi, __esi, __fp0, 0x400);
				_t18 =  *0x412c30; // 0x41304c
				if( *_t18 == 0) {
					_t20 =  *0x412b4c; // 0x406b84
					_t12 = _t20 + 4; // 0xffe8
					_t22 =  *0x415b48; // 0x400000
					LoadStringW(E00405B90(_t22),  *_t12,  &_v140, 0x40);
					MessageBoxW(0,  &_v2188,  &_v140, 0x2010);
				} else {
					_t31 =  *0x412b6c; // 0x413324
					E00402F6C(E0040317C(_t31));
					WideCharToMultiByte(1, 0,  &_v2188, _t60, 0, 0, 0, 0);
					 *((intOrPtr*)(__ebx + 0x458d53d8)) =  *((intOrPtr*)(__ebx + 0x458d53d8)) - 1;
					asm("cld");
					E00405AD8();
					WideCharToMultiByte(1, 0,  &_v2188, _t60, _v8, __ebx, 0, 0);
					WriteFile(GetStdHandle(0xfffffff4), _v8, __ebx,  &_v12, 0);
					WriteFile(GetStdHandle(0xfffffff4), 0x4097ec, 2,  &_v12, 0);
				}
				_pop(_t55);
				 *[fs:eax] = _t55;
				_push(E004097D8);
				_t56 =  *0x409688; // 0x40968c
				return E00405AE4( &_v8, _t56);
			}

0x004096b5
0x004096b6
0x004096b9
0x004096be
0x004096bf
0x004096c4
0x004096c7
0x004096da
0x004096dc
0x004096e4
0x00409782
0x00409787
0x0040978b
0x00409796
0x004097b0
0x004096ea
0x004096ea
0x004096f4
0x0040970d
0x00409711
0x00409717
0x00409723
0x00409740
0x00409758
0x00409772
0x00409772
0x004097b7
0x004097ba
0x004097bd
0x004097c5
0x004097d0

APIs

Part of subcall function 004094C0: VirtualQuery.KERNEL32(?,?,0000001C,00000000,0040966C), ref: 004094F3
Part of subcall function 004094C0: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00409517
Part of subcall function 004094C0: GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 00409532
Part of subcall function 004094C0: LoadStringW.USER32(00000000,0000FFE7,?,00000100), ref: 004095CD

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,004097D1), ref: 0040970D
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00409740
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00409752
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00409758
GetStdHandle.KERNEL32(000000F4,004097EC,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0040976C
WriteFile.KERNEL32(00000000,000000F4,004097EC,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00409772
LoadStringW.USER32(00000000,0000FFE8,?,00000040), ref: 00409796
MessageBoxW.USER32(00000000,?,?,00002010), ref: 004097B0

Strings

L0A, xrefs: 004096DC
$3A, xrefs: 004096EA

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: $3A$L0A
API String ID: 135118572-3383676211
Opcode ID: 8b2f4c98a4fb2e05f9b77abfa78c1e8ef696c340ba2c1eb89f5d355f9d3bd10e
Instruction ID: 4b6b5517f585d7bcb7a6ee4021fc009cd8714ba707ccf5161a52a6acc96df964
Opcode Fuzzy Hash: 8b2f4c98a4fb2e05f9b77abfa78c1e8ef696c340ba2c1eb89f5d355f9d3bd10e
Instruction Fuzzy Hash: 90317572644204BFEB10EB55DC82FDA77BCEB04704F508176B605F71D2DA74AE508B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCB4, Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 82
registryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E0040BCB4(void* __ebx, void* __esi, void* __eflags) {
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				intOrPtr* _t21;
				intOrPtr* _t22;
				intOrPtr _t61;
				void* _t68;

				_push(__ebx);
				_v20 = 0;
				_v8 = 0;
				_push(_t68);
				_push(0x40bdae);
				_push( *[fs:eax]);
				 *[fs:eax] = _t68 + 0xfffffff0;
				_t21 = E00406728(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"GetUserDefaultUILanguage");
				if(_t21 == 0) {
					_t22 =  *0x412c80; // 0x4127d8
					if( *_t22 != 2) {
						if(E0040BC8C(0, L"Control Panel\\Desktop\\ResourceLocale", 0x80000001,  &_v12, 1, 0) == 0) {
							E0040BC80();
							RegCloseKey(_v12);
						}
					} else {
						if(E0040BC8C(0, L".DEFAULT\\Control Panel\\International", 0x80000003,  &_v12, 1, 0) == 0) {
							E0040BC80();
							RegCloseKey(_v12);
						}
					}
					_t11 =  &_v20; // 0x40e6e2
					E00405058(_t11, _v8, E0040BEC4);
					_t13 =  &_v20; // 0x40e6e2
					E004032EC( *_t13,  &_v16);
					if(_v16 != 0) {
					}
				} else {
					 *_t21();
				}
				_pop(_t61);
				 *[fs:eax] = _t61;
				_push(E0040BDB5);
				_t16 =  &_v20; // 0x40e6e2
				L00404C88(_t16);
				return L00404C88( &_v8);
			}

0x0040bcba
0x0040bcbd
0x0040bcc0
0x0040bcc5
0x0040bcc6
0x0040bccb
0x0040bcce
0x0040bce1
0x0040bce8
0x0040bcf3
0x0040bcfb
0x0040bd50
0x0040bd5d
0x0040bd66
0x0040bd66
0x0040bcfd
0x0040bd18
0x0040bd25
0x0040bd2e
0x0040bd2e
0x0040bd18
0x0040bd6b
0x0040bd76
0x0040bd7b
0x0040bd81
0x0040bd8c
0x0040bd8c
0x0040bcea
0x0040bcea
0x0040bcec
0x0040bd92
0x0040bd95
0x0040bd98
0x0040bd9d
0x0040bda0
0x0040bdad

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0040BDAE), ref: 0040BCDB

Part of subcall function 00406728: GetProcAddress.KERNEL32(?,0040BDAE), ref: 0040674C

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0040BDAE), ref: 0040BD2E

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 0040BD3D
GetUserDefaultUILanguage, xrefs: 0040BCD1
@, xrefs: 0040BD6B, 0040BD7B, 0040BD9D
Locale, xrefs: 0040BD1D
kernel32.dll, xrefs: 0040BCD6
.DEFAULT\Control Panel\International, xrefs: 0040BD05

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll$@
API String ID: 4190037839-2486097240
Opcode ID: 80cc2d048197550fc45e72c521f2f6eb91233c4a299f6646e594bd98e8537675
Instruction ID: f085aeb6f96187440fd11b28afca5c20140dd592c4e243f34c0ae994db249187
Opcode Fuzzy Hash: 80cc2d048197550fc45e72c521f2f6eb91233c4a299f6646e594bd98e8537675
Instruction Fuzzy Hash: 97212330604209ABEB10EAA5CC52BDEB7A9EF44304F51447BA501F76D1EB7C9E4587DC

Uniqueness

Uniqueness Score: -1.00%

Function 0040969F, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040969F(void* __eax, long __ebx, void* __ecx, void* __edx, void* __edi, int __esi, void* __fp0, intOrPtr _a8) {
				void* _v4;
				long _v8;
				intOrPtr _v16;
				short _v140;
				char _v1564;
				char _v1636;
				short _v2184;
				short _v2188;
				char _v2196;
				intOrPtr* _t22;
				long _t44;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t58;
				int _t60;

				_t60 = __esi;
				_t44 = __ebx;
				_t22 = __eax + 1;
				 *_t22 =  *_t22 + __ecx;
				_push(__ebx);
				if( *_t22 >= 0) {
					L9:
					E00405AD8();
					WideCharToMultiByte(1, 0,  &_v2184, _t60, _v4, _t44, 0, 0);
					WriteFile(GetStdHandle(0xfffffff4), _v4, _t44,  &_v8, 0);
					WriteFile(GetStdHandle(0xfffffff4), 0x4097ec, 2,  &_v8, 0);
					goto L11;
				} else {
					_push(__ebp);
					if(__eflags == 0) {
						L8:
						 *((intOrPtr*)(__ebx + 0x458d53d8)) =  *((intOrPtr*)(__ebx + 0x458d53d8)) - 1;
						asm("cld");
						goto L9;
					} else {
						asm("insb");
						if(__eflags >= 0) {
							E00408290(_v4,  &_v1564, _a8, __fp0);
							E004080DC(_v4);
							_t58 = 4;
							 *[fs:eax] = _t58;
							_push(E00409673);
							return L00404C88( &_v1636);
						} else {
							asm("rcl byte [ebp-0x75], 0xec");
							_push(__ebp);
							__ebp = __esp;
							__esp = __esp + 0xfffff778;
							_push(__ebx);
							_push(__esi);
							__ecx = 0;
							_v16 = 0;
							__ecx = 0;
							_push(__ebp);
							_push(0x4097d1);
							_push( *[fs:ecx]);
							 *[fs:ecx] = __esp;
							__ecx =  &_v2196;
							__esi = __eax;
							__eax =  *0x412c30; // 0x41304c
							__eflags =  *__eax;
							if( *__eax == 0) {
								__eax =  &_v140;
								__eax =  *0x412b4c; // 0x406b84
								_t17 = __eax + 4; // 0xffe8
								__eax =  *_t17;
								__eax =  *0x415b48; // 0x400000
								 &_v140 =  &_v2188;
								__eax = MessageBoxW(0,  &_v2188,  &_v140, 0x2010);
							} else {
								__eax =  *0x412b6c; // 0x413324
								 &_v2188 = WideCharToMultiByte(1, 0,  &_v2188, __esi, 0, 0, 0, 0);
								goto L8;
							}
							L11:
							__eflags = 0;
							_pop(_t55);
							 *[fs:eax] = _t55;
							_push(E004097D8);
							_t56 =  *0x409688; // 0x40968c
							return E00405AE4( &_v4, _t56);
						}
					}
				}
			}

0x0040969f
0x0040969f
0x0040969f
0x004096a0
0x004096a2
0x004096a3
0x00409718
0x00409723
0x00409740
0x00409758
0x00409772
0x00000000
0x004096a5
0x004096a5
0x004096a6
0x00409711
0x00409711
0x00409717
0x00000000
0x004096a8
0x004096a8
0x004096a9
0x00409644
0x0040964c
0x00409655
0x00409658
0x0040965b
0x0040966b
0x004096ab
0x004096ab
0x004096ac
0x004096ad
0x004096af
0x004096b5
0x004096b6
0x004096b7
0x004096b9
0x004096bc
0x004096be
0x004096bf
0x004096c4
0x004096c7
0x004096cf
0x004096da
0x004096dc
0x004096e1
0x004096e4
0x0040977b
0x00409782
0x00409787
0x00409787
0x0040978b
0x004097a7
0x004097b0
0x004096ea
0x004096ea
0x0040970d
0x00000000
0x0040970d
0x004097b5
0x004097b5
0x004097b7
0x004097ba
0x004097bd
0x004097c5
0x004097d0
0x004097d0
0x004096a9
0x004096a6

APIs

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,004097D1), ref: 0040970D
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00409740
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00409752
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00409758
GetStdHandle.KERNEL32(000000F4,004097EC,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0040976C
WriteFile.KERNEL32(00000000,000000F4,004097EC,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00409772

Part of subcall function 004094C0: VirtualQuery.KERNEL32(?,?,0000001C,00000000,0040966C), ref: 004094F3
Part of subcall function 004094C0: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00409517
Part of subcall function 004094C0: GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 00409532
Part of subcall function 004094C0: LoadStringW.USER32(00000000,0000FFE7,?,00000100), ref: 004095CD

LoadStringW.USER32(00000000,0000FFE8,?,00000040), ref: 00409796
MessageBoxW.USER32(00000000,?,?,00002010), ref: 004097B0

Strings

L0A, xrefs: 004096DC
$3A, xrefs: 004096EA

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: $3A$L0A
API String ID: 135118572-3383676211
Opcode ID: e09603783d1fedb439eb3b96c6b7287245d95d231f2eb492ec96d2846129613a
Instruction ID: f6b5f291705009e5de114d2fa58123299fc430e48d316a2931987128ae7f8af9
Opcode Fuzzy Hash: e09603783d1fedb439eb3b96c6b7287245d95d231f2eb492ec96d2846129613a
Instruction Fuzzy Hash: B131B272644204BFEB14EB61DC82F9A77ACDB44714F6041BAB601B71D2DAB96E408A68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A5A8, Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 203
threadCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0040A5A8(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				void* _t104;
				void* _t111;
				void* _t135;
				intOrPtr _t187;
				intOrPtr _t197;
				intOrPtr _t198;

				_t195 = __esi;
				_t194 = __edi;
				_t197 = _t198;
				_t135 = 8;
				do {
					_push(0);
					_push(0);
					_t135 = _t135 - 1;
				} while (_t135 != 0);
				_push(__ebx);
				_push(_t197);
				_push(0x40a886);
				_push( *[fs:eax]);
				 *[fs:eax] = _t198;
				E0040A4F0();
				E00408F68(__ebx, __edi, __esi);
				_t200 =  *0x415c3c;
				if( *0x415c3c != 0) {
					E00409140(__esi, _t200);
				}
				_t134 = GetThreadLocale();
				E00408EB4(_t43, 0, 0x14,  &_v20);
				E00404C98(0x415b6c, _v20);
				E00408EB4(_t43, 0x40a8a0, 0x1b,  &_v24);
				 *0x415b70 = E00407F10(0x40a8a0, 0, _t200);
				E00408EB4(_t134, 0x40a8a0, 0x1c,  &_v28);
				 *0x415b71 = E00407F10(0x40a8a0, 0, _t200);
				 *0x415b72 = E00408F00(_t134, 0x2c, 0xf);
				 *0x415b74 = E00408F00(_t134, 0x2e, 0xe);
				E00408EB4(_t134, 0x40a8a0, 0x19,  &_v32);
				 *0x415b76 = E00407F10(0x40a8a0, 0, _t200);
				 *0x415b78 = E00408F00(_t134, 0x2f, 0x1d);
				E00408EB4(_t134, L"m/d/yy", 0x1f,  &_v40);
				E004091F4(_v40, _t134,  &_v36, _t194, _t195, _t200);
				E00404C98(0x415b7c, _v36);
				E00408EB4(_t134, L"mmmm d, yyyy", 0x20,  &_v48);
				E004091F4(_v48, _t134,  &_v44, _t194, _t195, _t200);
				E00404C98(0x415b80, _v44);
				 *0x415b84 = E00408F00(_t134, 0x3a, 0x1e);
				E00408EB4(_t134, 0x40a8f4, 0x28,  &_v52);
				E00404C98(0x415b88, _v52);
				E00408EB4(_t134, 0x40a908, 0x29,  &_v56);
				E00404C98(0x415b8c, _v56);
				E00404CEC( &_v12, 0);
				E00404CEC( &_v16, 0);
				E00408EB4(_t134, 0x40a8a0, 0x25,  &_v60);
				_t104 = E00407F10(0x40a8a0, 0, _t200);
				_t201 = _t104;
				if(_t104 != 0) {
					E00404CEC( &_v8, 0x40a92c);
				} else {
					E00404CEC( &_v8, 0x40a91c);
				}
				E00408EB4(_t134, 0x40a8a0, 0x23,  &_v64);
				_t111 = E00407F10(0x40a8a0, 0, _t201);
				_t202 = _t111;
				if(_t111 == 0) {
					E00408EB4(_t134, 0x40a8a0, 0x1005,  &_v68);
					if(E00407F10(0x40a8a0, 0, _t202) != 0) {
						E00404CEC( &_v12, L"AMPM ");
					} else {
						E00404CEC( &_v16, L" AMPM");
					}
				}
				_push(_v12);
				_push(_v8);
				_push(":mm");
				_push(_v16);
				E0040513C(0x415b90, 4, _t194);
				_push(_v12);
				_push(_v8);
				_push(L":mm:ss");
				_push(_v16);
				E0040513C(0x415b94, 4, _t194);
				 *0x415c3e = E00408F00(_t134, 0x2c, 0xc);
				_pop(_t187);
				 *[fs:eax] = _t187;
				_push(E0040A88D);
				return L00404C90( &_v68, 0x10);
			}

0x0040a5a8
0x0040a5a8
0x0040a5a9
0x0040a5ab
0x0040a5b0
0x0040a5b0
0x0040a5b2
0x0040a5b4
0x0040a5b4
0x0040a5b7
0x0040a5ba
0x0040a5bb
0x0040a5c0
0x0040a5c3
0x0040a5c6
0x0040a5cb
0x0040a5d0
0x0040a5d7
0x0040a5d9
0x0040a5d9
0x0040a5e3
0x0040a5f2
0x0040a5ff
0x0040a614
0x0040a623
0x0040a638
0x0040a647
0x0040a65c
0x0040a672
0x0040a688
0x0040a697
0x0040a6ac
0x0040a6c2
0x0040a6cd
0x0040a6da
0x0040a6ef
0x0040a6fa
0x0040a707
0x0040a71c
0x0040a732
0x0040a73f
0x0040a754
0x0040a761
0x0040a76b
0x0040a775
0x0040a78a
0x0040a794
0x0040a799
0x0040a79b
0x0040a7b4
0x0040a79d
0x0040a7a5
0x0040a7a5
0x0040a7c9
0x0040a7d3
0x0040a7d8
0x0040a7da
0x0040a7ec
0x0040a7fd
0x0040a816
0x0040a7ff
0x0040a807
0x0040a807
0x0040a7fd
0x0040a81b
0x0040a81e
0x0040a821
0x0040a826
0x0040a833
0x0040a838
0x0040a83b
0x0040a83e
0x0040a843
0x0040a850
0x0040a865
0x0040a86d
0x0040a870
0x0040a873
0x0040a885

APIs

GetThreadLocale.KERNEL32(00000000,0040A886,?,?,00000000,00000000), ref: 0040A5DE

Part of subcall function 00408EB4: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00408ED2

Strings

AMPM, xrefs: 0040A802
:mm:ss, xrefs: 0040A83E
m/d/yy, xrefs: 0040A6B6
AMPM , xrefs: 0040A811
mmmm d, yyyy, xrefs: 0040A6E3
:mm, xrefs: 0040A821

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 96567873330725efde854cbd28cc164f09b5ab7b576ff83e587159ab38fbb852
Instruction ID: 937fad03d119ad446409e4fc6370febcefa1a0408b23a60a3ce11da87fe3f1e8
Opcode Fuzzy Hash: 96567873330725efde854cbd28cc164f09b5ab7b576ff83e587159ab38fbb852
Instruction Fuzzy Hash: 01710A75B042499BDB00EBA5D841ADF7266ABC8308F51D43BB201BB3C6DA3CDD16879D

Uniqueness

Uniqueness Score: -1.00%

Function 004044F0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E004044F0(void* __ecx) {
				long _v4;
				int _t3;

				if( *0x41304c == 0) {
					if( *0x412028 == 0) {
						_t3 = MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
					}
					return _t3;
				} else {
					if( *0x413328 == 0xd7b2 &&  *0x413330 > 0) {
						 *0x413340();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1d,  &_v4, 0);
					return WriteFile(GetStdHandle(0xfffffff5), E0040457C, 2,  &_v4, 0);
				}
			}

0x004044f8
0x00404558
0x00404568
0x00404568
0x0040456e
0x004044fa
0x00404503
0x00404513
0x00404513
0x0040452f
0x00404550
0x00404550

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000,?), ref: 00404529
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?,?,00000001,004046B6,00402F13,00402F5A,00000000), ref: 0040452F
GetStdHandle.KERNEL32(000000F5,0040457C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?), ref: 00404544
WriteFile.KERNEL32(00000000,000000F5,0040457C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004045A1,?,?), ref: 0040454A
MessageBoxA.USER32 ref: 00404568

Strings

Runtime error at 00000000, xrefs: 00404522, 00404561
Error, xrefs: 0040455C

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 702207360e6f67392dae8c09e50a71dce199e074f7270a58720f1a5ddd4bdc6b
Instruction ID: fdc5a69791f8b721a84368f61c8a4f4698a1174428d9f6e56fc121f1a8fce5d1
Opcode Fuzzy Hash: 702207360e6f67392dae8c09e50a71dce199e074f7270a58720f1a5ddd4bdc6b
Instruction Fuzzy Hash: 8CF02BF0A8038479E620B7609D06FD626880384F1AFA0823BB370F54E6C6FC45C4C62D

Uniqueness

Uniqueness Score: -1.00%

Function 00401E74, Relevance: 10.9, APIs: 7, Instructions: 407
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00401E74(signed int __eax, intOrPtr __edx, void* __edi) {
				signed int __ebx;
				void* __esi;
				signed int _t69;
				signed int _t78;
				signed int _t93;
				long _t94;
				void* _t100;
				signed int _t102;
				signed int _t109;
				signed int _t115;
				signed int _t123;
				signed int _t129;
				void* _t131;
				signed int _t140;
				unsigned int _t148;
				signed int _t150;
				long _t152;
				signed int _t156;
				intOrPtr _t161;
				signed int _t166;
				signed int _t170;
				unsigned int _t171;
				intOrPtr _t174;
				intOrPtr _t180;
				intOrPtr _t193;
				signed int _t196;
				signed int _t197;
				signed int _t198;
				void* _t206;
				unsigned int _t208;
				intOrPtr _t214;
				void* _t226;
				intOrPtr _t228;
				void* _t229;
				signed int _t231;
				void* _t233;
				signed int _t234;
				signed int _t235;
				signed int _t239;
				signed int _t242;
				void* _t244;
				intOrPtr* _t245;

				_t176 = __edx;
				_t66 = __eax;
				_t166 =  *(__eax - 4);
				_t218 = __eax;
				if((_t166 & 0x00000007) != 0) {
					__eflags = _t166 & 0x00000005;
					if((_t166 & 0x00000005) != 0) {
						_pop(_t218);
						_pop(_t145);
						__eflags = _t166 & 0x00000003;
						if((_t166 & 0x00000003) == 0) {
							_push(_t145);
							_push(__eax);
							_push(__edi);
							_push(_t226);
							_t245 = _t244 + 0xffffffe0;
							_t219 = __edx;
							_t203 = __eax;
							_t69 =  *(__eax - 4);
							_t148 = (_t69 & 0xfffffff0) - 0x14;
							if(_t148 >= __edx) {
								__eflags = __edx - _t148 >> 1;
								if(__edx < _t148 >> 1) {
									_t150 = E004018F8(__edx);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t219 - 0x40a2c;
										if(_t219 > 0x40a2c) {
											_t78 = _t203 - 0x10;
											__eflags = _t78;
											 *((intOrPtr*)(_t78 + 8)) = _t219;
										}
										E004014BC(_t203, _t219, _t150);
										E00401C7C(_t203, _t203, _t226);
									}
								} else {
									_t150 = __eax;
									 *((intOrPtr*)(__eax - 0x10 + 8)) = __edx;
								}
							} else {
								_t180 = (_t148 >> 2) + _t148;
								if(_t180 <= __edx) {
									_t228 = __edx;
								} else {
									_t228 = _t180;
								}
								 *_t245 = _t203 - 0x10 + (_t69 & 0xfffffff0);
								VirtualQuery( *(_t245 + 8), _t245 + 8, 0x1c);
								if( *((intOrPtr*)(_t245 + 0x14)) != 0x10000) {
									L12:
									_t150 = E004018F8(_t228);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t228 - 0x40a2c;
										if(_t228 > 0x40a2c) {
											_t93 = _t150 - 0x10;
											__eflags = _t93;
											 *((intOrPtr*)(_t93 + 8)) = _t219;
										}
										E0040148C(_t203,  *((intOrPtr*)(_t203 - 0x10 + 8)), _t150);
										E00401C7C(_t203, _t203, _t228);
									}
								} else {
									 *(_t245 + 0x10) =  *(_t245 + 0x10) & 0xffff0000;
									_t94 =  *(_t245 + 0x10);
									if(_t219 - _t148 >= _t94) {
										goto L12;
									} else {
										_t152 = _t228 - _t148 + 0x00010000 - 0x00000001 & 0xffff0000;
										if(_t94 < _t152) {
											_t152 = _t94;
										}
										if(VirtualAlloc( *(_t245 + 0xc), _t152, 0x2000, 4) == 0 || VirtualAlloc( *(_t245 + 0xc), _t152, 0x1000, 4) == 0) {
											goto L12;
										} else {
											_t100 = _t203 - 0x10;
											 *((intOrPtr*)(_t100 + 8)) = _t219;
											 *(_t100 + 0xc) = _t152 +  *(_t100 + 0xc) | 0x00000008;
											_t150 = _t203;
										}
									}
								}
							}
							return _t150;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t170 = _t166 & 0xfffffff0;
						_push(__edi);
						_t206 = _t170 + __eax;
						_t171 = _t170 - 4;
						_t156 = _t166 & 0x0000000f;
						__eflags = __edx - _t171;
						_push(_t226);
						if(__edx > _t171) {
							_t102 =  *(_t206 - 4);
							__eflags = _t102 & 0x00000001;
							if((_t102 & 0x00000001) == 0) {
								L75:
								asm("adc edi, 0xffffffff");
								_t229 = ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176;
								_t208 = _t171;
								_t109 = E004018F8(((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176);
								_t193 = _t176;
								__eflags = _t109;
								if(_t109 == 0) {
									goto L73;
								} else {
									__eflags = _t229 - 0x40a2c;
									if(_t229 > 0x40a2c) {
										 *((intOrPtr*)(_t109 - 8)) = _t193;
									}
									_t231 = _t109;
									E0040148C(_t218, _t208, _t109);
									E00401C7C(_t218, _t208, _t231);
									return _t231;
								}
							} else {
								_t115 = _t102 & 0xfffffff0;
								_t233 = _t171 + _t115;
								__eflags = __edx - _t233;
								if(__edx > _t233) {
									goto L75;
								} else {
									__eflags =  *0x41304d;
									if(__eflags == 0) {
										L66:
										__eflags = _t115 - 0xb30;
										if(_t115 >= 0xb30) {
											E004014D8(_t206);
											_t176 = _t176;
											_t171 = _t171;
										}
										asm("adc edi, 0xffffffff");
										_t123 = (_t176 + ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + 0x000000d3 & 0xffffff00) + 0x30;
										_t196 = _t233 + 4 - _t123;
										__eflags = _t196;
										if(_t196 > 0) {
											 *(_t218 + _t233 - 4) = _t196;
											 *((intOrPtr*)(_t218 - 4 + _t123)) = _t196 + 3;
											_t234 = _t123;
											__eflags = _t196 - 0xb30;
											if(_t196 >= 0xb30) {
												__eflags = _t123 + _t218;
												E00401518(_t123 + _t218, _t171, _t196);
											}
										} else {
											 *(_t218 + _t233) =  *(_t218 + _t233) & 0xfffffff7;
											_t234 = _t233 + 4;
										}
										_t235 = _t234 | _t156;
										__eflags = _t235;
										 *(_t218 - 4) = _t235;
										 *0x413a34 = 0;
										_t109 = _t218;
										L73:
										return _t109;
									} else {
										while(1) {
											asm("lock cmpxchg [0x413a34], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x4138d5;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t176 = _t176;
												_t171 = _t171;
												asm("lock cmpxchg [0x413a34], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t176 = _t176;
													_t171 = _t171;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t218 - 4);
										_t129 =  *(_t206 - 4);
										__eflags = _t129 & 0x00000001;
										if((_t129 & 0x00000001) == 0) {
											L74:
											 *0x413a34 = 0;
											goto L75;
										} else {
											_t115 = _t129 & 0xfffffff0;
											_t233 = _t171 + _t115;
											__eflags = _t176 - _t233;
											if(_t176 > _t233) {
												goto L74;
											} else {
												goto L66;
											}
										}
									}
								}
							}
						} else {
							__eflags = __edx + __edx - _t171;
							if(__edx + __edx < _t171) {
								__eflags = __edx - 0xb2c;
								if(__edx >= 0xb2c) {
									L41:
									_t32 = _t176 + 0xd3; // 0xbff
									_t239 = (_t32 & 0xffffff00) + 0x30;
									_t174 = _t171 + 4 - _t239;
									__eflags =  *0x41304d;
									if(__eflags != 0) {
										while(1) {
											asm("lock cmpxchg [0x413a34], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x4138d5;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t174 = _t174;
												asm("lock cmpxchg [0x413a34], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t174 = _t174;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t218 - 4);
										__eflags = 0xf;
									}
									 *(_t218 - 4) = _t156 | _t239;
									_t161 = _t174;
									_t197 =  *(_t206 - 4);
									__eflags = _t197 & 0x00000001;
									if((_t197 & 0x00000001) != 0) {
										_t131 = _t206;
										_t198 = _t197 & 0xfffffff0;
										_t161 = _t161 + _t198;
										_t206 = _t206 + _t198;
										__eflags = _t198 - 0xb30;
										if(_t198 >= 0xb30) {
											E004014D8(_t131);
										}
									} else {
										 *(_t206 - 4) = _t197 | 0x00000008;
									}
									 *((intOrPtr*)(_t206 - 8)) = _t161;
									 *((intOrPtr*)(_t218 + _t239 - 4)) = _t161 + 3;
									__eflags = _t161 - 0xb30;
									if(_t161 >= 0xb30) {
										E00401518(_t218 + _t239, _t174, _t161);
									}
									 *0x413a34 = 0;
									return _t218;
								} else {
									__eflags = __edx - 0x2cc;
									if(__edx < 0x2cc) {
										_t214 = __edx;
										_t140 = E004018F8(__edx);
										__eflags = _t140;
										if(_t140 != 0) {
											_t242 = _t140;
											E004014BC(_t218, _t214, _t140);
											E00401C7C(_t218, _t214, _t242);
											_t140 = _t242;
										}
										return _t140;
									} else {
										_t176 = 0xb2c;
										__eflags = _t171 - 0xb2c;
										if(_t171 <= 0xb2c) {
											goto L37;
										} else {
											goto L41;
										}
									}
								}
							} else {
								L37:
								return _t66;
							}
						}
					}
				} else {
					__ebx =  *__ecx;
					__ecx =  *(__ebx + 2) & 0x0000ffff;
					__ecx = ( *(__ebx + 2) & 0x0000ffff) - 4;
					__eflags = __ecx - __edx;
					if(__ecx < __edx) {
						__ecx = __ecx + __ecx + 0x20;
						_push(__edi);
						__edi = __edx;
						__eax = 0;
						__ecx = __ecx - __edx;
						asm("adc eax, 0xffffffff");
						__eax = 0 & __ecx;
						__eax = (0 & __ecx) + __edx;
						__eax = E004018F8((0 & __ecx) + __edx);
						__eflags = __eax;
						if(__eax != 0) {
							__eflags = __edi - 0x40a2c;
							if(__edi > 0x40a2c) {
								 *(__eax - 8) = __edi;
							}
							 *(__ebx + 2) & 0x0000ffff = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__eflags = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__edx = __eax;
							__edi = __eax;
							 *((intOrPtr*)(__ebx + 0x1c))() = E00401C7C(__esi, __edi, __ebp);
							__eax = __edi;
						}
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						return __eax;
					} else {
						__ebx = 0x40 + __edx * 4;
						__eflags = 0x40 + __edx * 4 - __ecx;
						if(0x40 + __edx * 4 < __ecx) {
							__ebx = __edx;
							__eax = __edx;
							__eax = E004018F8(__edx);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = __ebx;
								__edx = __eax;
								__ebx = __eax;
								__esi = E00401C7C(__esi, __edi, __ebp);
								__eax = __ebx;
							}
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						} else {
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}

0x00401e74
0x00401e74
0x00401e74
0x00401e7c
0x00401e7e
0x00401f0c
0x00401f0f
0x0040217c
0x0040217d
0x0040217e
0x00402181
0x004017ac
0x004017ad
0x004017ae
0x004017af
0x004017b0
0x004017b3
0x004017b5
0x004017bc
0x004017c3
0x004017c8
0x004018b1
0x004018b3
0x004018c6
0x004018c8
0x004018ca
0x004018cc
0x004018d2
0x004018d6
0x004018d6
0x004018d9
0x004018d9
0x004018e2
0x004018e9
0x004018e9
0x004018b5
0x004018b5
0x004018ba
0x004018ba
0x004017ce
0x004017d3
0x004017d7
0x004017dd
0x004017d9
0x004017d9
0x004017d9
0x004017e9
0x004017f8
0x00401805
0x00401877
0x0040187e
0x00401880
0x00401882
0x00401884
0x0040188a
0x0040188e
0x0040188e
0x00401891
0x00401891
0x004018a1
0x004018a8
0x004018a8
0x00401807
0x00401807
0x00401813
0x00401819
0x00000000
0x0040181b
0x0040182c
0x00401830
0x00401832
0x00401832
0x00401848
0x00000000
0x00401860
0x00401862
0x00401865
0x00401870
0x00401873
0x00401873
0x00401848
0x00401819
0x00401805
0x004018f7
0x00402187
0x00402187
0x00402189
0x00402189
0x00401f15
0x00401f17
0x00401f1a
0x00401f1b
0x00401f1e
0x00401f21
0x00401f24
0x00401f26
0x00401f27
0x0040203c
0x0040203f
0x00402041
0x00402134
0x0040213f
0x00402146
0x00402148
0x0040214b
0x00402150
0x00402151
0x00402153
0x00000000
0x00402155
0x00402155
0x0040215b
0x0040215d
0x0040215d
0x00402160
0x00402168
0x0040216f
0x0040217a
0x0040217a
0x00402047
0x00402047
0x0040204a
0x0040204d
0x0040204f
0x00000000
0x00402055
0x00402055
0x0040205c
0x004020b9
0x004020b9
0x004020be
0x004020c4
0x004020c9
0x004020ca
0x004020ca
0x004020d6
0x004020e7
0x004020ed
0x004020ed
0x004020ef
0x004020fc
0x00402103
0x00402107
0x00402109
0x0040210f
0x00402111
0x00402113
0x00402113
0x004020f1
0x004020f1
0x004020f5
0x004020f5
0x00402118
0x00402118
0x0040211a
0x0040211d
0x00402124
0x00402126
0x0040212a
0x0040205e
0x0040205e
0x00402063
0x0040206b
0x00000000
0x00000000
0x0040206d
0x0040206f
0x00402076
0x00000000
0x00402078
0x0040207c
0x00402081
0x00402082
0x00402088
0x00402090
0x00402096
0x0040209b
0x0040209c
0x00000000
0x0040209c
0x00402090
0x00000000
0x00402076
0x004020a5
0x004020a8
0x004020ab
0x004020ad
0x0040212d
0x0040212d
0x00000000
0x004020af
0x004020af
0x004020b2
0x004020b5
0x004020b7
0x00000000
0x00000000
0x00000000
0x00000000
0x004020b7
0x004020ad
0x0040205c
0x0040204f
0x00401f2d
0x00401f30
0x00401f32
0x00401f3c
0x00401f42
0x00401f59
0x00401f59
0x00401f65
0x00401f6b
0x00401f6d
0x00401f74
0x00401f76
0x00401f7b
0x00401f83
0x00000000
0x00000000
0x00401f85
0x00401f87
0x00401f8e
0x00000000
0x00401f90
0x00401f93
0x00401f98
0x00401f9e
0x00401fa6
0x00401fab
0x00401fb0
0x00000000
0x00401fb0
0x00401fa6
0x00000000
0x00401f8e
0x00401fb9
0x00401fb9
0x00401fb9
0x00401fbe
0x00401fc1
0x00401fc3
0x00401fc6
0x00401fc9
0x00401fd4
0x00401fd6
0x00401fd9
0x00401fdb
0x00401fdd
0x00401fe3
0x00401fe5
0x00401fe5
0x00401fcb
0x00401fce
0x00401fce
0x00401fea
0x00401ff0
0x00401ff4
0x00401ffa
0x00402001
0x00402001
0x00402006
0x00402013
0x00401f44
0x00401f44
0x00401f4a
0x00402014
0x00402018
0x0040201d
0x0040201f
0x00402021
0x00402029
0x00402030
0x00402035
0x00402035
0x0040203b
0x00401f50
0x00401f50
0x00401f55
0x00401f57
0x00000000
0x00000000
0x00000000
0x00000000
0x00401f57
0x00401f4a
0x00401f34
0x00401f34
0x00401f38
0x00401f38
0x00401f32
0x00401f27
0x00401e84
0x00401e84
0x00401e86
0x00401e8a
0x00401e8d
0x00401e8f
0x00401ec8
0x00401ecc
0x00401ecd
0x00401ecf
0x00401ed1
0x00401ed3
0x00401ed6
0x00401ed8
0x00401eda
0x00401edf
0x00401ee1
0x00401ee3
0x00401ee9
0x00401eeb
0x00401eeb
0x00401ef2
0x00401ef2
0x00401ef5
0x00401ef7
0x00401f00
0x00401f05
0x00401f05
0x00401f07
0x00401f08
0x00401f09
0x00401f0a
0x00401e91
0x00401e91
0x00401e98
0x00401e9a
0x00401ea0
0x00401ea2
0x00401ea4
0x00401ea9
0x00401eab
0x00401ead
0x00401eaf
0x00401eb1
0x00401ebc
0x00401ec1
0x00401ec1
0x00401ec3
0x00401ec4
0x00401ec5
0x00401e9c
0x00401e9c
0x00401e9d
0x00401e9e
0x00401e9e
0x00401e9a
0x00401e8f

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f575fe0f9ab75cd77064c69f6d0118a98c1029f4734138360c475f3ddc3b2d0
Instruction ID: e7aaafa73fe3aa34f17de89ed5c93537a6fc3e5f890846df0dd0d21288fe1d67
Opcode Fuzzy Hash: 5f575fe0f9ab75cd77064c69f6d0118a98c1029f4734138360c475f3ddc3b2d0
Instruction Fuzzy Hash: 54C102767002010BE714AA6DDD8976EB2C69BC5325F18823FE214EB3E6DABCC9458348

Uniqueness

Uniqueness Score: -1.00%

Function 004027B8, Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 277
windowCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E004027B8(void* __eax, void* __fp0) {
				void* _v8;
				char _v110600;
				char _v112644;
				char _v112645;
				signed int _v112652;
				char _v112653;
				char _v112654;
				char _v112660;
				intOrPtr _v112664;
				intOrPtr _v112668;
				intOrPtr _v112672;
				signed short* _v112676;
				void* _v112680;
				char _v129064;
				char _v131113;
				char _v161832;
				void* _t70;
				int _t76;
				intOrPtr _t79;
				intOrPtr _t90;
				CHAR* _t94;
				intOrPtr _t96;
				void* _t106;
				intOrPtr _t107;
				intOrPtr _t113;
				intOrPtr _t118;
				void* _t128;
				intOrPtr _t129;
				intOrPtr _t133;
				signed int _t143;
				int _t148;
				intOrPtr _t149;
				char* _t151;
				char* _t152;
				char* _t153;
				char* _t154;
				char* _t155;
				char* _t156;
				char* _t158;
				char* _t159;
				char* _t164;
				char* _t165;
				intOrPtr _t197;
				void* _t199;
				void* _t200;
				intOrPtr* _t203;
				void* _t205;
				void* _t206;
				signed int _t211;
				void* _t214;
				void* _t215;
				void* _t228;

				_push(__eax);
				_t70 = 0x27;
				goto L1;
				L12:
				while(_t197 != 0x413a24) {
					_t76 = E004021E4(_t197);
					_t148 = _t76;
					__eflags = _t148;
					if(_t148 == 0) {
						L11:
						_t20 = _t197 + 4; // 0x413a24
						_t197 =  *_t20;
						continue;
					} else {
						goto L4;
					}
					do {
						L4:
						_t211 =  *(_t148 - 4);
						__eflags = _t211 & 0x00000001;
						if((_t211 & 0x00000001) == 0) {
							__eflags = _t211 & 0x00000004;
							if(__eflags == 0) {
								__eflags = _v112652 - 0x1000;
								if(_v112652 < 0x1000) {
									_v112664 = (_t211 & 0xfffffff0) - 4;
									_t143 = E004025A0(_t148);
									__eflags = _t143;
									if(_t143 == 0) {
										_v112645 = 0;
										 *((intOrPtr*)(_t214 + _v112652 * 4 - 0x1f824)) = _v112664;
										_t18 =  &_v112652;
										 *_t18 = _v112652 + 1;
										__eflags =  *_t18;
									}
								}
							} else {
								E004025F8(_t148, __eflags, _t214);
							}
						}
						_t76 = E004021C0(_t148);
						_t148 = _t76;
						__eflags = _t148;
					} while (_t148 != 0);
					goto L11;
				}
				_t149 =  *0x415acc; // 0x415ac8
				while(_t149 != 0x415ac8 && _v112652 < 0x1000) {
					_t76 = E004025A0(_t149 + 0x10);
					__eflags = _t76;
					if(_t76 == 0) {
						_v112645 = 0;
						_t22 = _t149 + 0xc; // 0x0
						_t76 = _v112652;
						 *((intOrPtr*)(_t214 + _t76 * 4 - 0x1f824)) = ( *_t22 & 0xfffffff0) - 0xfffffffffffffff4;
						_t27 =  &_v112652;
						 *_t27 = _v112652 + 1;
						__eflags =  *_t27;
					}
					_t29 = _t149 + 4; // 0x415ac8
					_t149 =  *_t29;
				}
				if(_v112645 != 0) {
					L50:
					return _t76;
				}
				_v112653 = 0;
				_v112668 = 0;
				_t79 =  *0x412038; // 0x40126c
				_t151 = E0040237C(E00404914(_t79),  &_v161832);
				_v112660 = 0x37;
				_v112676 = 0x41205e;
				_v112680 =  &_v110600;
				do {
					_v112672 = ( *_v112676 & 0x0000ffff) - 4;
					_v112654 = 0;
					_t199 = 0xff;
					_t203 = _v112680;
					while(_t151 <=  &_v131113) {
						if( *_t203 > 0) {
							if(_v112653 == 0) {
								_t133 =  *0x41203c; // 0x401298
								_t151 = E0040237C(E00404914(_t133), _t151);
								_v112653 = 1;
							}
							if(_v112654 != 0) {
								 *_t151 = 0x2c;
								_t156 = _t151 + 1;
								 *_t156 = 0x20;
								_t157 = _t156 + 1;
								__eflags = _t156 + 1;
							} else {
								 *_t151 = 0xd;
								 *((char*)(_t151 + 1)) = 0xa;
								_t164 = E00402260(_v112668 + 1, _t151 + 2);
								 *_t164 = 0x20;
								_t165 = _t164 + 1;
								 *_t165 = 0x2d;
								 *((char*)(_t165 + 1)) = 0x20;
								_t128 = E00402260(_v112672, _t165 + 2);
								_t129 =  *0x412044; // 0x401300
								_t157 = E0040237C(E00404914(_t129), _t128);
								_v112654 = 1;
							}
							_t106 = _t199 - 1;
							_t228 = _t106;
							if(_t228 < 0) {
								_t107 =  *0x412048; // 0x40130c
								_t158 = E0040237C(E00404914(_t107), _t157);
							} else {
								if(_t228 == 0) {
									_t113 =  *0x41204c; // 0x401314
									_t158 = E0040237C(E00404914(_t113), _t157);
								} else {
									if(_t106 == 1) {
										_t118 =  *0x412050; // 0x401320
										_t158 = E0040237C(E00404914(_t118), _t157);
									} else {
										_t158 = E00402394( *((intOrPtr*)(_t203 - 4)), _t157);
									}
								}
							}
							 *_t158 = 0x20;
							_t159 = _t158 + 1;
							 *_t159 = 0x78;
							 *((char*)(_t159 + 1)) = 0x20;
							_t151 = E00402260( *_t203, _t159 + 2);
						}
						_t199 = _t199 - 1;
						_t203 = _t203 - 8;
						if(_t199 != 0xffffffff) {
							continue;
						} else {
							goto L39;
						}
					}
					L39:
					_v112668 = _v112672;
					_v112680 = _v112680 + 0x800;
					_v112676 =  &(_v112676[0x10]);
					_t57 =  &_v112660;
					 *_t57 = _v112660 - 1;
				} while ( *_t57 != 0);
				if(_v112652 <= 0) {
					L49:
					_t90 =  *0x412054; // 0x401330
					E0040237C(E00404914(_t90), _t151);
					_t94 =  *0x412058; // 0x401334
					_t76 = MessageBoxA(0,  &_v161832, _t94, 0x2010);
					goto L50;
				}
				if(_v112653 != 0) {
					 *_t151 = 0xd;
					_t153 = _t151 + 1;
					 *_t153 = 0xa;
					_t154 = _t153 + 1;
					 *_t154 = 0xd;
					_t155 = _t154 + 1;
					 *_t155 = 0xa;
					_t151 = _t155 + 1;
				}
				_t96 =  *0x412040; // 0x4012c0
				_t151 = E0040237C(E00404914(_t96), _t151);
				_t205 = _v112652 - 1;
				if(_t205 >= 0) {
					_t206 = _t205 + 1;
					_t200 = 0;
					_v112680 =  &_v129064;
					L45:
					L45:
					if(_t200 != 0) {
						 *_t151 = 0x2c;
						_t152 = _t151 + 1;
						 *_t152 = 0x20;
						_t151 = _t152 + 1;
					}
					_t151 = E00402260( *_v112680, _t151);
					if(_t151 >  &_v131113) {
						goto L49;
					}
					_t200 = _t200 + 1;
					_v112680 = _v112680 + 4;
					_t206 = _t206 - 1;
					if(_t206 != 0) {
						goto L45;
					}
				}
				L1:
				_t215 = _t215 + 0xfffff004;
				_push(_t70);
				_t70 = _t70 - 1;
				if(_t70 != 0) {
					goto L1;
				} else {
					E00403250( &_v112644, 0x1b800);
					E00403250( &_v129064, 0x4000);
					_t76 = 0;
					_v112652 = 0;
					_v112645 = 1;
					_t197 =  *0x413a28; // 0x413a24
					goto L12;
				}
			}

0x004027bb
0x004027bc
0x004027bc
0x00000000
0x00402897
0x00402817
0x0040281c
0x0040281e
0x00402820
0x00402894
0x00402894
0x00402894
0x00000000
0x00000000
0x00000000
0x00000000
0x00402822
0x00402822
0x00402827
0x00402829
0x0040282f
0x00402831
0x00402837
0x00402844
0x0040284e
0x00402856
0x0040285e
0x00402863
0x00402865
0x00402867
0x0040287a
0x00402881
0x00402881
0x00402881
0x00402881
0x00402865
0x00402839
0x0040283c
0x00402841
0x00402837
0x00402889
0x0040288e
0x00402890
0x00402890
0x00000000
0x00402822
0x004028a3
0x004028e2
0x004028b0
0x004028b5
0x004028b7
0x004028b9
0x004028c0
0x004028cc
0x004028d2
0x004028d9
0x004028d9
0x004028d9
0x004028d9
0x004028df
0x004028df
0x004028df
0x004028fd
0x00402b92
0x00402b98
0x00402b98
0x00402903
0x0040290c
0x00402912
0x0040292e
0x00402930
0x0040293a
0x0040294a
0x00402950
0x0040295c
0x00402962
0x00402969
0x00402974
0x00402976
0x00402987
0x00402994
0x00402996
0x004029ae
0x004029b0
0x004029b0
0x004029be
0x00402a16
0x00402a19
0x00402a1a
0x00402a1d
0x00402a1d
0x004029c0
0x004029c0
0x004029c4
0x004029d6
0x004029d8
0x004029db
0x004029dc
0x004029e0
0x004029ec
0x004029f3
0x00402a0b
0x00402a0d
0x00402a0d
0x00402a20
0x00402a20
0x00402a23
0x00402a2c
0x00402a44
0x00402a25
0x00402a25
0x00402a48
0x00402a60
0x00402a27
0x00402a28
0x00402a64
0x00402a7c
0x00402a2a
0x00402a8a
0x00402a8a
0x00402a28
0x00402a25
0x00402a8c
0x00402a8f
0x00402a90
0x00402a94
0x00402aa1
0x00402aa1
0x00402aa3
0x00402aa4
0x00402aaa
0x00000000
0x00000000
0x00000000
0x00000000
0x00402aaa
0x00402ab0
0x00402ab6
0x00402abc
0x00402ac6
0x00402acd
0x00402acd
0x00402acd
0x00402ae0
0x00402b61
0x00402b61
0x00402b74
0x00402b7e
0x00402b8d
0x00000000
0x00402b8d
0x00402ae9
0x00402aeb
0x00402aee
0x00402aef
0x00402af2
0x00402af3
0x00402af6
0x00402af7
0x00402afa
0x00402afa
0x00402afb
0x00402b13
0x00402b1b
0x00402b1e
0x00402b20
0x00402b21
0x00402b29
0x00000000
0x00402b2f
0x00402b31
0x00402b33
0x00402b36
0x00402b37
0x00402b3a
0x00402b3a
0x00402b4a
0x00402b54
0x00000000
0x00000000
0x00402b56
0x00402b57
0x00402b5e
0x00402b5f
0x00000000
0x00000000
0x00402b5f
0x004027c1
0x004027c1
0x004027c7
0x004027c8
0x004027c9
0x00000000
0x004027cb
0x004027e4
0x004027f6
0x004027fb
0x004027fd
0x00402803
0x0040280a
0x00000000
0x0040280a

APIs

MessageBoxA.USER32 ref: 00402B8D

Strings

, xrefs: 00402AC6
$:A, xrefs: 00402897
7, xrefs: 00402930
$:A, xrefs: 0040280A

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Message
String ID: $$:A$$:A$7
API String ID: 2030045667-2368080441
Opcode ID: 7fdcc660e36d965071abef6df893b1e20abca58f752986739f38fdc4c6e03db3
Instruction ID: 5e81d980581d028b30a088fdd03a9cb8372552a81488182f994bcd5140d075e0
Opcode Fuzzy Hash: 7fdcc660e36d965071abef6df893b1e20abca58f752986739f38fdc4c6e03db3
Instruction Fuzzy Hash: A9B1C430B002548BCB21EB2DCE88B9977E4AB4D344F1481F6E548E73D2DBB89D85CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004094C0, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E004094C0(intOrPtr* __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v534;
				short _v1056;
				short _v1568;
				struct _MEMORY_BASIC_INFORMATION _v1596;
				char _v1600;
				intOrPtr _v1604;
				char _v1608;
				intOrPtr _v1612;
				char _v1616;
				intOrPtr _v1620;
				char _v1624;
				char* _v1628;
				char _v1632;
				char _v1636;
				char _v1640;
				struct HINSTANCE__* _t44;
				intOrPtr _t55;
				struct HINSTANCE__* _t57;
				signed int _t76;
				long _t79;
				void* _t82;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t95;
				intOrPtr _t98;
				intOrPtr _t100;
				intOrPtr* _t102;
				void* _t105;
				void* _t113;

				_t113 = __fp0;
				_v1640 = 0;
				_v8 = __ecx;
				_t82 = __edx;
				_t102 = __eax;
				_push(_t105);
				_push(0x40966c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t105 + 0xfffff99c;
				VirtualQuery(__edx,  &_v1596, 0x1c);
				if(_v1596.State != 0x1000) {
					L2:
					_t44 =  *0x415b48; // 0x400000
					GetModuleFileNameW(_t44,  &_v1056, 0x105);
					_v12 = E004094B4(_t82);
				} else {
					_t79 = GetModuleFileNameW(_v1596.AllocationBase,  &_v1056, 0x105);
					_t108 = _t79;
					if(_t79 != 0) {
						_t85 = _t82 - _v1596.AllocationBase;
						__eflags = _t85;
						_v12 = _t85;
					} else {
						goto L2;
					}
				}
				E00408128( &_v534, 0x104, E0040A48C() + 2, _t108);
				_t83 = 0x409680;
				_t100 = 0x409680;
				_t95 =  *0x406d5c; // 0x406db4
				if(E0040392C(_t102, _t95) != 0) {
					_t83 = E00404D24( *((intOrPtr*)(_t102 + 4)));
					_t76 = E004080DC(_t83);
					if(_t76 != 0 &&  *((short*)(_t83 + _t76 * 2 - 2)) != 0x2e) {
						_t100 = 0x409684;
					}
				}
				_t55 =  *0x412c74; // 0x406b7c
				_t18 = _t55 + 4; // 0xffe7
				_t57 =  *0x415b48; // 0x400000
				LoadStringW(E00405B90(_t57),  *_t18,  &_v1568, 0x100);
				E00403814( *_t102,  &_v1640);
				_v1636 = _v1640;
				_v1632 = 0x11;
				_v1628 =  &_v534;
				_v1624 = 0xa;
				_v1620 = _v12;
				_v1616 = 5;
				_v1612 = _t83;
				_v1608 = 0xa;
				_v1604 = _t100;
				_v1600 = 0xa;
				_push( &_v1636);
				E00408290(_v8,  &_v1568, _a4, _t113);
				E004080DC(_v8);
				_t98 = 4;
				 *[fs:eax] = _t98;
				_push(E00409673);
				return L00404C88( &_v1640);
			}

0x004094c0
0x004094ce
0x004094d4
0x004094d7
0x004094d9
0x004094dd
0x004094de
0x004094e3
0x004094e6
0x004094f3
0x00409502
0x00409520
0x0040952c
0x00409532
0x0040953e
0x00409504
0x00409517
0x0040951c
0x0040951e
0x00409543
0x00409543
0x00409549
0x00000000
0x00000000
0x00000000
0x0040951e
0x0040956b
0x00409570
0x00409575
0x0040957c
0x00409589
0x00409593
0x00409597
0x0040959e
0x004095a8
0x004095a8
0x0040959e
0x004095b9
0x004095be
0x004095c2
0x004095cd
0x004095da
0x004095e5
0x004095eb
0x004095f8
0x004095fe
0x00409608
0x0040960e
0x00409615
0x0040961b
0x00409622
0x00409628
0x00409635
0x00409644
0x0040964c
0x00409655
0x00409658
0x0040965b
0x0040966b

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0040966C), ref: 004094F3
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00409517
GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 00409532
LoadStringW.USER32(00000000,0000FFE7,?,00000100), ref: 004095CD

Strings

|k@, xrefs: 004095B9

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: |k@
API String ID: 3990497365-1384102874
Opcode ID: 5914ef104a1885c4b455fe68aa3f82051fc6bed16699f25d3331650203c1c157
Instruction ID: 8ee99c308592b21e0bb1e436705c108510906c516df13bcbb7f10d14a68236cb
Opcode Fuzzy Hash: 5914ef104a1885c4b455fe68aa3f82051fc6bed16699f25d3331650203c1c157
Instruction Fuzzy Hash: 0B4134719012189FDB20EF65CD81BCAB7F9AB84304F4144FAE508E7282D77A9E94CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004094BE, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E004094BE(intOrPtr* __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v534;
				short _v1056;
				short _v1568;
				struct _MEMORY_BASIC_INFORMATION _v1596;
				char _v1600;
				intOrPtr _v1604;
				char _v1608;
				intOrPtr _v1612;
				char _v1616;
				intOrPtr _v1620;
				char _v1624;
				char* _v1628;
				char _v1632;
				char _v1636;
				char _v1640;
				struct HINSTANCE__* _t44;
				intOrPtr _t55;
				struct HINSTANCE__* _t57;
				signed int _t76;
				long _t79;
				void* _t82;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t95;
				intOrPtr _t98;
				intOrPtr _t100;
				intOrPtr* _t102;
				void* _t105;
				void* _t113;

				_t113 = __fp0;
				_v1640 = 0;
				_v8 = __ecx;
				_t82 = __edx;
				_t102 = __eax;
				_push(_t105);
				_push(0x40966c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t105 + 0xfffff99c;
				VirtualQuery(__edx,  &_v1596, 0x1c);
				if(_v1596.State != 0x1000) {
					L3:
					_t44 =  *0x415b48; // 0x400000
					GetModuleFileNameW(_t44,  &_v1056, 0x105);
					_v12 = E004094B4(_t82);
				} else {
					_t79 = GetModuleFileNameW(_v1596.AllocationBase,  &_v1056, 0x105);
					_t108 = _t79;
					if(_t79 != 0) {
						_t85 = _t82 - _v1596.AllocationBase;
						__eflags = _t85;
						_v12 = _t85;
					} else {
						goto L3;
					}
				}
				E00408128( &_v534, 0x104, E0040A48C() + 2, _t108);
				_t83 = 0x409680;
				_t100 = 0x409680;
				_t95 =  *0x406d5c; // 0x406db4
				if(E0040392C(_t102, _t95) != 0) {
					_t83 = E00404D24( *((intOrPtr*)(_t102 + 4)));
					_t76 = E004080DC(_t83);
					if(_t76 != 0 &&  *((short*)(_t83 + _t76 * 2 - 2)) != 0x2e) {
						_t100 = 0x409684;
					}
				}
				_t55 =  *0x412c74; // 0x406b7c
				_t18 = _t55 + 4; // 0xffe7
				_t57 =  *0x415b48; // 0x400000
				LoadStringW(E00405B90(_t57),  *_t18,  &_v1568, 0x100);
				E00403814( *_t102,  &_v1640);
				_v1636 = _v1640;
				_v1632 = 0x11;
				_v1628 =  &_v534;
				_v1624 = 0xa;
				_v1620 = _v12;
				_v1616 = 5;
				_v1612 = _t83;
				_v1608 = 0xa;
				_v1604 = _t100;
				_v1600 = 0xa;
				_push( &_v1636);
				E00408290(_v8,  &_v1568, _a4, _t113);
				E004080DC(_v8);
				_t98 = 4;
				 *[fs:eax] = _t98;
				_push(E00409673);
				return L00404C88( &_v1640);
			}

0x004094be
0x004094ce
0x004094d4
0x004094d7
0x004094d9
0x004094dd
0x004094de
0x004094e3
0x004094e6
0x004094f3
0x00409502
0x00409520
0x0040952c
0x00409532
0x0040953e
0x00409504
0x00409517
0x0040951c
0x0040951e
0x00409543
0x00409543
0x00409549
0x00000000
0x00000000
0x00000000
0x0040951e
0x0040956b
0x00409570
0x00409575
0x0040957c
0x00409589
0x00409593
0x00409597
0x0040959e
0x004095a8
0x004095a8
0x0040959e
0x004095b9
0x004095be
0x004095c2
0x004095cd
0x004095da
0x004095e5
0x004095eb
0x004095f8
0x004095fe
0x00409608
0x0040960e
0x00409615
0x0040961b
0x00409622
0x00409628
0x00409635
0x00409644
0x0040964c
0x00409655
0x00409658
0x0040965b
0x0040966b

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0040966C), ref: 004094F3
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00409517
GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 00409532
LoadStringW.USER32(00000000,0000FFE7,?,00000100), ref: 004095CD

Strings

|k@, xrefs: 004095B9

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: |k@
API String ID: 3990497365-1384102874
Opcode ID: d56d81d6c757ecad1378ea9fc69d283fc4ca8fe34524f6571a03f00e17d946e7
Instruction ID: c40da55e855f861479a2f682f3fa2ef8b1bb35ba648f5aab45988fe24984749a
Opcode Fuzzy Hash: d56d81d6c757ecad1378ea9fc69d283fc4ca8fe34524f6571a03f00e17d946e7
Instruction Fuzzy Hash: 69414571A002189FDB20EF65CD81BCAB7F99B84304F4144FAE508E7282D77A9E94CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00403714, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49
registryCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00403714() {
				void* _v8;
				char _v12;
				int _v16;
				signed short _t14;
				intOrPtr _t27;
				void* _t29;
				void* _t31;
				intOrPtr _t32;

				_t29 = _t31;
				_t32 = _t31 + 0xfffffff4;
				_v12 =  *0x41201c & 0x0000ffff;
				if(RegOpenKeyExW(0x80000002, L"SOFTWARE\\Borland\\Delphi\\RTL", 0, 1,  &_v8) != 0) {
					_t14 =  *0x41201c & 0xffc0 | _v12 & 0x3f;
					 *0x41201c = _t14;
					return _t14;
				} else {
					_push(_t29);
					_push(E00403785);
					_push( *[fs:eax]);
					 *[fs:eax] = _t32;
					_v16 = 4;
					RegQueryValueExW(_v8, L"FPUMaskValue", 0, 0,  &_v12,  &_v16);
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(0x40378c);
					return RegCloseKey(_v8);
				}
			}

0x00403715
0x00403717
0x00403721
0x0040373d
0x0040379f
0x004037a2
0x004037ab
0x0040373f
0x00403741
0x00403742
0x00403747
0x0040374a
0x0040374d
0x00403769
0x00403770
0x00403773
0x00403776
0x00403784
0x00403784

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00403736
RegQueryValueExW.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00403785,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00403769
RegCloseKey.ADVAPI32(?,0040378C,00000000,?,00000004,00000000,00403785,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0040377F

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 0040372C
FPUMaskValue, xrefs: 00403760

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 6aeaf0bb9d8d3d66ce8c9309b5049384293a7d57b585f7f81df902abe7067c85
Instruction ID: 40a73df8a67999f4cbb9744d622e99770d6b6577c1e0934ef40092c26c129c87
Opcode Fuzzy Hash: 6aeaf0bb9d8d3d66ce8c9309b5049384293a7d57b585f7f81df902abe7067c85
Instruction Fuzzy Hash: B10152B5540318B9DB11DFA18D42BAABBACD708B01F208177BA00F75D0E6799A10D769

Uniqueness

Uniqueness Score: -1.00%

Function 00409140, Relevance: 7.6, APIs: 5, Instructions: 50
threadCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00409140(void* __esi, void* __eflags) {
				char _v8;
				intOrPtr* _t18;
				intOrPtr _t26;
				void* _t27;
				long _t29;
				intOrPtr _t32;
				void* _t33;

				_t33 = __eflags;
				_push(0);
				_push(_t32);
				_push(0x4091d7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				E00408EB4(GetThreadLocale(), 0x4091f0, 0x100b,  &_v8);
				_t29 = E00407F10(0x4091f0, 1, _t33);
				if(_t29 + 0xfffffffd - 3 < 0) {
					EnumCalendarInfoW(E0040908C, GetThreadLocale(), _t29, 4);
					_t27 = 7;
					_t18 = 0x415c5c;
					do {
						 *_t18 = 0xffffffff;
						_t18 = _t18 + 4;
						_t27 = _t27 - 1;
					} while (_t27 != 0);
					EnumCalendarInfoW(E004090C8, GetThreadLocale(), _t29, 3);
				}
				_pop(_t26);
				 *[fs:eax] = _t26;
				_push(E004091DE);
				return L00404C88( &_v8);
			}

0x00409140
0x00409143
0x00409148
0x00409149
0x0040914e
0x00409151
0x00409167
0x00409179
0x00409183
0x00409193
0x00409198
0x0040919d
0x004091a2
0x004091a2
0x004091a8
0x004091ab
0x004091ab
0x004091bc
0x004091bc
0x004091c3
0x004091c6
0x004091c9
0x004091d6

APIs

GetThreadLocale.KERNEL32(?,00000000,004091D7,?,?,00000000), ref: 00409158

Part of subcall function 00408EB4: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00408ED2

GetThreadLocale.KERNEL32(00000000,00000004,00000000,004091D7,?,?,00000000), ref: 00409188
EnumCalendarInfoW.KERNEL32(Function_0000908C,00000000,00000000,00000004,00000000,004091D7,?,?,00000000), ref: 00409193
GetThreadLocale.KERNEL32(00000000,00000003,Function_0000908C,00000000,00000000,00000004,00000000,004091D7,?,?,00000000), ref: 004091B1
EnumCalendarInfoW.KERNEL32(Function_000090C8,00000000,00000000,00000003,Function_0000908C,00000000,00000000,00000004,00000000,004091D7,?,?,00000000), ref: 004091BC

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 1287b01eaffe2f7a89d76bee5e253d8467206198faf148c79f9b7f744e170f41
Instruction ID: 083ce9a4cc77aebe24cd927d5b3fe7a8d4ed640c99c3cc4bc0f0e781bc0fc52a
Opcode Fuzzy Hash: 1287b01eaffe2f7a89d76bee5e253d8467206198faf148c79f9b7f744e170f41
Instruction Fuzzy Hash: EF01DF70304604AAF701AB65CC12B5A32ACDB85728F62053AF900BB6C7DA7C9E0082AC

Uniqueness

Uniqueness Score: -1.00%

Function 004091F4, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 177
threadCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004091F4(signed int __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _v8;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				void* _t69;
				signed int _t72;
				signed int _t75;
				signed int _t78;
				signed int _t81;
				signed int _t97;
				intOrPtr _t112;
				void* _t113;
				signed int _t114;
				signed int _t122;
				signed int _t131;
				intOrPtr _t152;
				void* _t164;
				signed int _t166;
				intOrPtr _t170;
				void* _t171;

				_t171 = __eflags;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t164 = __edx;
				_v8 = __eax;
				L00404C80(_v8);
				_push(_t170);
				_push(0x409427);
				 *[fs:eax] = _t170;
				_t131 = 1;
				E00404C98(_t164, 0,  *[fs:eax]);
				E00408EB4(GetThreadLocale(), 0x409444, 0x1009,  &_v16);
				if(E00407F10(0x409444, 1, _t171) + 0xfffffffd - 3 < 0) {
					while(1) {
						_t69 = E00404EF4(E00404830( &_v8));
						__eflags = _t131 - _t69;
						if(_t131 > _t69) {
							break;
						}
						_t166 = _v8;
						__eflags = _t166;
						if(_t166 != 0) {
							__eflags =  *((short*)(_t166 - 0xa)) - 2;
							if( *((short*)(_t166 - 0xa)) != 2) {
								_t166 = E00404820( &_v8);
							}
						}
						__eflags =  *((short*)(_t166 + _t131 * 2 - 2)) - 0xd800;
						if( *((short*)(_t166 + _t131 * 2 - 2)) < 0xd800) {
							L22:
							_t72 = E00408164(_v8 + _t131 * 2 - 2, 2, 0x409448);
							__eflags = _t72;
							if(_t72 != 0) {
								_t75 = E00408164(_v8 + _t131 * 2 - 2, 4, L"yyyy");
								__eflags = _t75;
								if(_t75 != 0) {
									_t78 = E00408164(_v8 + _t131 * 2 - 2, 2, L"yy");
									__eflags = _t78;
									if(_t78 != 0) {
										_t81 = ( *(_v8 + _t131 * 2 - 2) & 0x0000ffff) - 0x59;
										__eflags = _t81;
										if(_t81 == 0) {
											L30:
											E00404F98(_t164, 0x4094b0);
											L32:
											_t131 = _t131 + 1;
											__eflags = _t131;
											continue;
										}
										__eflags = _t81 != 0x20;
										if(_t81 != 0x20) {
											E00404E04();
											E00404F98(_t164, _v28);
											goto L32;
										}
										goto L30;
									}
									E00404F98(_t164, 0x40949c);
									_t131 = _t131 + 1;
									goto L32;
								}
								E00404F98(_t164, L"eeee");
								_t131 = _t131 + 3;
								goto L32;
							}
							E00404F98(_t164, 0x40945c);
							_t131 = _t131 + 1;
							goto L32;
						} else {
							__eflags =  *((short*)(_t166 + _t131 * 2 - 2)) - 0xdfff;
							if( *((short*)(_t166 + _t131 * 2 - 2)) > 0xdfff) {
								goto L22;
							}
							_t97 = E0040A3F8(_v8, _t131, _t131, _t166) >> 1;
							if(__eflags < 0) {
								asm("adc eax, 0x0");
							}
							_v12 = _t97;
							E0040525C(_v8, _t131, _t131, _t164, _t166,  &_v24);
							E00404F98(_t164, _v24);
							_t131 = _t131 + _v12;
							continue;
						}
					}
					L34:
					_pop(_t152);
					 *[fs:eax] = _t152;
					_push(E0040942E);
					L00404C90( &_v28, 4);
					return L00404C88( &_v8);
				}
				_t112 =  *0x415c34; // 0x9
				_t113 = _t112 - 4;
				if(_t113 == 0 || _t113 + 0xfffffff3 - 2 < 0) {
					_t114 = 1;
				} else {
					_t114 = 0;
				}
				if(_t114 == 0) {
					E00404C98(_t164, _v8);
				} else {
					while(_t131 <= E00404EF4(E00404830( &_v8))) {
						_t122 = ( *(_v8 + _t131 * 2 - 2) & 0x0000ffff) - 0x47;
						__eflags = _t122;
						if(_t122 != 0) {
							__eflags = _t122 != 0x20;
							if(_t122 != 0x20) {
								E00404E04();
								E00404F98(_t164, _v20);
							}
						}
						_t131 = _t131 + 1;
						__eflags = _t131;
					}
				}
			}

0x004091f4
0x004091f9
0x004091fa
0x004091fb
0x004091fc
0x004091fd
0x004091fe
0x004091ff
0x00409200
0x00409202
0x00409204
0x0040920a
0x00409211
0x00409212
0x0040921a
0x0040921d
0x00409226
0x0040923e
0x00409256
0x004093ef
0x004093f7
0x004093fc
0x004093fe
0x00000000
0x00000000
0x004092ca
0x004092cd
0x004092cf
0x004092d6
0x004092da
0x004092e7
0x004092e7
0x004092da
0x004092e9
0x004092f0
0x00409332
0x00409343
0x00409348
0x0040934a
0x0040936f
0x00409374
0x00409376
0x0040939a
0x0040939f
0x004093a1
0x004093ba
0x004093ba
0x004093be
0x004093c6
0x004093cd
0x004093ee
0x004093ee
0x004093ee
0x00000000
0x004093ee
0x004093c0
0x004093c4
0x004093df
0x004093e9
0x00000000
0x004093e9
0x00000000
0x004093c4
0x004093aa
0x004093af
0x00000000
0x004093af
0x0040937f
0x00409384
0x00000000
0x00409384
0x00409353
0x00409358
0x00000000
0x004092f2
0x004092f2
0x004092f9
0x00000000
0x00000000
0x00409305
0x00409307
0x00409309
0x00409309
0x0040930c
0x0040931b
0x00409325
0x0040932a
0x00000000
0x0040932a
0x004092f0
0x00409404
0x00409406
0x00409409
0x0040940c
0x00409419
0x00409426
0x00409426
0x0040925c
0x00409261
0x00409264
0x00409272
0x0040926e
0x0040926e
0x0040926e
0x00409276
0x004092c0
0x00409278
0x004092a5
0x00409284
0x00409284
0x00409288
0x0040928a
0x0040928e
0x00409295
0x0040929f
0x0040929f
0x0040928e
0x004092a4
0x004092a4
0x004092a4
0x004092b6

APIs

GetThreadLocale.KERNEL32(?,00000000,00409427,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040922F

Part of subcall function 00408EB4: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00408ED2

Strings

yyyy, xrefs: 0040935E
ggg, xrefs: 0040934E
eeee, xrefs: 0040937A

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 5b05fff5a3157eeb427311d92377f86d18d8986aaa7e70f2e6c4d2d732a3210a
Instruction ID: f2ce5095f23ab47d6d0538cc62e5ab7c2440563574ca3b0be4b951cff116fd36
Opcode Fuzzy Hash: 5b05fff5a3157eeb427311d92377f86d18d8986aaa7e70f2e6c4d2d732a3210a
Instruction Fuzzy Hash: 1A519375A041069BCB10FBA9C5825AFB3A5EF85308B20447BE941B73E7DB3C9E02965D

Uniqueness

Uniqueness Score: -1.00%

Function 00409D3C, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409D3C(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				struct _MEMORY_BASIC_INFORMATION _v36;
				short _v558;
				char _v564;
				intOrPtr _v568;
				char _v572;
				char _v576;
				char _v580;
				intOrPtr _v584;
				char _v588;
				void* _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				intOrPtr _v612;
				char _v616;
				char _v620;
				char _v624;
				void* _v628;
				char _v632;
				intOrPtr _t52;
				intOrPtr _t60;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr _t89;
				intOrPtr _t101;
				void* _t108;
				intOrPtr _t110;
				void* _t113;

				_t108 = __edi;
				_v632 = 0;
				_v596 = 0;
				_v604 = 0;
				_v600 = 0;
				_v8 = 0;
				_push(_t113);
				_push(0x409ef7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t113 + 0xfffffd8c;
				_t89 =  *((intOrPtr*)(_a4 - 4));
				if( *((intOrPtr*)(_t89 + 0x14)) != 0) {
					_t52 =  *0x412c08; // 0x406bac
					E004063E4(_t52,  &_v8);
				} else {
					_t86 =  *0x412c84; // 0x406ba4
					E004063E4(_t86,  &_v8);
				}
				_t110 =  *((intOrPtr*)(_t89 + 0x18));
				VirtualQuery( *(_t89 + 0xc),  &_v36, 0x1c);
				if(_v36.State != 0x1000 || GetModuleFileNameW(_v36.AllocationBase,  &_v558, 0x105) == 0) {
					_v628 =  *(_t89 + 0xc);
					_v624 = 5;
					_v620 = _v8;
					_v616 = 0x11;
					_v612 = _t110;
					_v608 = 5;
					_push( &_v628);
					_t60 =  *0x412c10; // 0x406b4c
					E004063E4(_t60,  &_v632, 2);
					E00409860(_t89, _v632, 1, _t108, _t110);
				} else {
					_v592 =  *(_t89 + 0xc);
					_v588 = 5;
					E00404E50( &_v600, 0x105,  &_v558);
					E00408028(_v600,  &_v596);
					_v584 = _v596;
					_v580 = 0x11;
					_v576 = _v8;
					_v572 = 0x11;
					_v568 = _t110;
					_v564 = 5;
					_push( &_v592);
					_t82 =  *0x412c3c; // 0x406c1c
					E004063E4(_t82,  &_v604, 3);
					E00409860(_t89, _v604, 1, _t108, _t110);
				}
				_pop(_t101);
				 *[fs:eax] = _t101;
				_push(E00409EFE);
				L00404C88( &_v632);
				L00404C90( &_v604, 3);
				return L00404C88( &_v8);
			}

0x00409d3c
0x00409d49
0x00409d4f
0x00409d55
0x00409d5b
0x00409d61
0x00409d66
0x00409d67
0x00409d6c
0x00409d6f
0x00409d75
0x00409d7c
0x00409d90
0x00409d95
0x00409d7e
0x00409d81
0x00409d86
0x00409d86
0x00409d9a
0x00409da7
0x00409db3
0x00409e6f
0x00409e75
0x00409e7f
0x00409e85
0x00409e8c
0x00409e92
0x00409e9f
0x00409ea8
0x00409ead
0x00409ebf
0x00409dd6
0x00409dd9
0x00409ddf
0x00409df7
0x00409e08
0x00409e13
0x00409e19
0x00409e23
0x00409e29
0x00409e30
0x00409e36
0x00409e43
0x00409e4c
0x00409e51
0x00409e63
0x00409e68
0x00409ec8
0x00409ecb
0x00409ece
0x00409ed9
0x00409ee9
0x00409ef6

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00409EF7), ref: 00409DA7
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,0000001C,00000000,00409EF7), ref: 00409DC9

Part of subcall function 004063E4: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00406429

Strings

Lk@, xrefs: 00409EA8
u@, xrefs: 00409E5E, 00409EBA

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: Lk@$u@
API String ID: 902310565-2376058283
Opcode ID: 9dadb347ab63506e5d350c89b8cdb1e1e3fcca5bb2b068381056940c1e482613
Instruction ID: bb42c9137fa72a0dfc484d327a568d617fce07dfa24631e08ce9c5688ae927db
Opcode Fuzzy Hash: 9dadb347ab63506e5d350c89b8cdb1e1e3fcca5bb2b068381056940c1e482613
Instruction Fuzzy Hash: 81412B309042589FDB60EF65CD89BCDB7F4AB48304F1145EAA908F7292E7789E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A186, Relevance: 6.0, APIs: 4, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A186() {
				LONG* _t9;
				void* _t10;
				void* _t11;

				_t10 = 0;
				_t11 = 0x20;
				_t9 = 0x415ca4;
				while( *_t9 != 0 || InterlockedCompareExchange(_t9, 1, 0) != 0) {
					_t9 =  &(_t9[2]);
					_t11 = _t11 - 1;
					if(_t11 != 0) {
						continue;
					} else {
						if(_t10 == 0) {
							_t10 = CreateEventW(0, 0, 0, 0);
						}
						ResetEvent(_t10);
					}
					L10:
					return _t10;
				}
				if(_t9[1] == 0) {
					_t9[1] = CreateEventW(0, 0, 0, 0);
				}
				_t3 =  &(_t9[1]); // 0x0
				_t10 =  *_t3;
				goto L10;
			}

0x0040a18b
0x0040a18d
0x0040a192
0x0040a197
0x0040a1c5
0x0040a1c8
0x0040a1c9
0x00000000
0x0040a1cb
0x0040a1cd
0x0040a1dc
0x0040a1dc
0x0040a1df
0x0040a1df
0x0040a1e4
0x0040a1e9
0x0040a1e9
0x0040a1ae
0x0040a1bd
0x0040a1bd
0x0040a1c0
0x0040a1c0
0x00000000

APIs

InterlockedCompareExchange.KERNEL32(00415CA4,00000001,00000000), ref: 0040A1A1
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,00415CA4,00000001,00000000), ref: 0040A1B8
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040A1D7
ResetEvent.KERNEL32(00000000), ref: 0040A1DF

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Event$Create$CompareExchangeInterlockedReset
String ID:
API String ID: 2790937731-0
Opcode ID: 85bf60a57223efc1bd127b854e8e2fcc91d5941f498f3bc83f799df80e1b8357
Instruction ID: e519d750d6dcafecf1b76c6a1b6cc8191a637c52d9ce77022197b424e8f1bcef
Opcode Fuzzy Hash: 85bf60a57223efc1bd127b854e8e2fcc91d5941f498f3bc83f799df80e1b8357
Instruction Fuzzy Hash: 2EF05E31780300AAFB316A164C82B2765568BD0B65F254037FA08BE2C2E6BDAC20416E

Uniqueness

Uniqueness Score: -1.00%

Function 00408F68, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 106
threadCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00408F68(void* __ebx, void* __edi, void* __esi) {
				int _v8;
				signed int _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _t53;
				void* _t54;
				intOrPtr _t80;
				void* _t83;
				void* _t84;
				void* _t86;
				void* _t87;
				intOrPtr _t90;

				_t89 = _t90;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(_t90);
				_push(0x40907b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t90;
				_v8 = GetThreadLocale();
				_t53 = 1;
				_t86 = 0x415b98;
				_t83 = 0x415bc8;
				do {
					_t3 = _t53 + 0x44; // 0x45
					E00408F2C(_t3 - 1, _t53 - 1,  &_v16, 0xb, _t89);
					E00404C98(_t86, _v16);
					_t6 = _t53 + 0x38; // 0x39
					E00408F2C(_t6 - 1, _t53 - 1,  &_v20, 0xb, _t89);
					E00404C98(_t83, _v20);
					_t53 = _t53 + 1;
					_t83 = _t83 + 4;
					_t86 = _t86 + 4;
				} while (_t53 != 0xd);
				_t54 = 1;
				_t87 = 0x415bf8;
				_t84 = 0x415c14;
				do {
					_t8 = _t54 + 5; // 0x6
					asm("cdq");
					_v12 = _t8 % 7;
					E00408F2C(_v12 + 0x31, _t54 - 1,  &_v24, 6, _t89);
					E00404C98(_t87, _v24);
					E00408F2C(_v12 + 0x2a, _t54 - 1,  &_v28, 6, _t89);
					E00404C98(_t84, _v28);
					_t54 = _t54 + 1;
					_t84 = _t84 + 4;
					_t87 = _t87 + 4;
				} while (_t54 != 8);
				_pop(_t80);
				 *[fs:eax] = _t80;
				_push(E00409082);
				return L00404C90( &_v28, 4);
			}

0x00408f69
0x00408f6d
0x00408f6e
0x00408f6f
0x00408f70
0x00408f71
0x00408f72
0x00408f78
0x00408f79
0x00408f7e
0x00408f81
0x00408f89
0x00408f8c
0x00408f91
0x00408f96
0x00408f9b
0x00408faa
0x00408fae
0x00408fb9
0x00408fcd
0x00408fd1
0x00408fdc
0x00408fe1
0x00408fe2
0x00408fe5
0x00408fe8
0x00408fed
0x00408ff2
0x00408ff7
0x00408ffc
0x00408ffc
0x00409004
0x00409007
0x0040901f
0x0040902a
0x00409044
0x0040904f
0x00409054
0x00409055
0x00409058
0x0040905b
0x00409062
0x00409065
0x00409068
0x0040907a

APIs

GetThreadLocale.KERNEL32(00000000,0040907B,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00408F84

Strings

$l@, xrefs: 00408FA2
l@, xrefs: 00409011

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: LocaleThread
String ID: $l@$l@
API String ID: 635194068-4225844758
Opcode ID: 5e87792db015083e2cd87dd035b76fd2e5aa28faa88cb540b6dcab810a6319d8
Instruction ID: 74ee3e2f097acfc3ea8ee091fc7cdb976d8602175913d475df625015d87764a0
Opcode Fuzzy Hash: 5e87792db015083e2cd87dd035b76fd2e5aa28faa88cb540b6dcab810a6319d8
Instruction Fuzzy Hash: F6318771F045046BDB04EB99C881AAF77AAD788314F51843BFA05E7381DA39AD418769

Uniqueness

Uniqueness Score: -1.00%

Function 00409D3A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409D3A(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				struct _MEMORY_BASIC_INFORMATION _v36;
				short _v558;
				char _v564;
				intOrPtr _v568;
				char _v572;
				char _v576;
				char _v580;
				intOrPtr _v584;
				char _v588;
				void* _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				intOrPtr _v612;
				char _v616;
				char _v620;
				char _v624;
				void* _v628;
				char _v632;
				intOrPtr _t52;
				intOrPtr _t60;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr _t89;
				intOrPtr _t101;
				void* _t108;
				intOrPtr _t110;
				void* _t113;

				_t108 = __edi;
				_v632 = 0;
				_v596 = 0;
				_v604 = 0;
				_v600 = 0;
				_v8 = 0;
				_push(_t113);
				_push(0x409ef7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t113 + 0xfffffd8c;
				_t89 =  *((intOrPtr*)(_a4 - 4));
				if( *((intOrPtr*)(_t89 + 0x14)) != 0) {
					_t52 =  *0x412c08; // 0x406bac
					E004063E4(_t52,  &_v8);
				} else {
					_t86 =  *0x412c84; // 0x406ba4
					E004063E4(_t86,  &_v8);
				}
				_t110 =  *((intOrPtr*)(_t89 + 0x18));
				VirtualQuery( *(_t89 + 0xc),  &_v36, 0x1c);
				if(_v36.State != 0x1000 || GetModuleFileNameW(_v36.AllocationBase,  &_v558, 0x105) == 0) {
					_v628 =  *(_t89 + 0xc);
					_v624 = 5;
					_v620 = _v8;
					_v616 = 0x11;
					_v612 = _t110;
					_v608 = 5;
					_push( &_v628);
					_t60 =  *0x412c10; // 0x406b4c
					E004063E4(_t60,  &_v632, 2);
					E00409860(_t89, _v632, 1, _t108, _t110);
				} else {
					_v592 =  *(_t89 + 0xc);
					_v588 = 5;
					E00404E50( &_v600, 0x105,  &_v558);
					E00408028(_v600,  &_v596);
					_v584 = _v596;
					_v580 = 0x11;
					_v576 = _v8;
					_v572 = 0x11;
					_v568 = _t110;
					_v564 = 5;
					_push( &_v592);
					_t82 =  *0x412c3c; // 0x406c1c
					E004063E4(_t82,  &_v604, 3);
					E00409860(_t89, _v604, 1, _t108, _t110);
				}
				_pop(_t101);
				 *[fs:eax] = _t101;
				_push(E00409EFE);
				L00404C88( &_v632);
				L00404C90( &_v604, 3);
				return L00404C88( &_v8);
			}

0x00409d3a
0x00409d49
0x00409d4f
0x00409d55
0x00409d5b
0x00409d61
0x00409d66
0x00409d67
0x00409d6c
0x00409d6f
0x00409d75
0x00409d7c
0x00409d90
0x00409d95
0x00409d7e
0x00409d81
0x00409d86
0x00409d86
0x00409d9a
0x00409da7
0x00409db3
0x00409e6f
0x00409e75
0x00409e7f
0x00409e85
0x00409e8c
0x00409e92
0x00409e9f
0x00409ea8
0x00409ead
0x00409ebf
0x00409dd6
0x00409dd9
0x00409ddf
0x00409df7
0x00409e08
0x00409e13
0x00409e19
0x00409e23
0x00409e29
0x00409e30
0x00409e36
0x00409e43
0x00409e4c
0x00409e51
0x00409e63
0x00409e68
0x00409ec8
0x00409ecb
0x00409ece
0x00409ed9
0x00409ee9
0x00409ef6

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00409EF7), ref: 00409DA7
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,0000001C,00000000,00409EF7), ref: 00409DC9

Part of subcall function 004063E4: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00406429

Strings

u@, xrefs: 00409E5E

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: u@
API String ID: 902310565-3232061631
Opcode ID: d1a3f47694dfad6beed1b0576ace6ed5ed6e52b8e6ebeae028f9c42db9ed4c12
Instruction ID: 1495c760a45f1ebfa620716bc8dc94a265f234cfbe6e0ad3ab44c5fe6804372f
Opcode Fuzzy Hash: d1a3f47694dfad6beed1b0576ace6ed5ed6e52b8e6ebeae028f9c42db9ed4c12
Instruction Fuzzy Hash: 7E313C709002589FDB60EF65CD85B8AB7F8EB48304F1144EAA508F7281E7789E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040EE80, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27
windowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040EE80(void* __ecx) {
				char _v8;
				intOrPtr _t17;
				intOrPtr _t20;

				_push(0);
				_push(_t20);
				 *[fs:eax] = _t20;
				E00404CEC( &_v8, L"The Setup program accepts optional command line parameters.\r\n\r\n/HELP, /?\r\nShows this information.\r\n/SP-\r\nDisables the This will install... Do you wish to continue? prompt at the beginning of Setup.\r\n/SILENT, /VERYSILENT\r\nInstructs Setup to be silent or very silent.\r\n/SUPPRESSMSGBOXES\r\nInstructs Setup to suppress message boxes.\r\n/LOG\r\nCauses Setup to create a log file in the user\'s TEMP directory.\r\n/LOG=\"filename\"\r\nSame as /LOG, except it allows you to specify a fixed path/filename to use for the log file.\r\n/NOCANCEL\r\nPrevents the user from cancelling during the installation process.\r\n/NORESTART\r\nPrevents Setup from restarting the system following a successful installation, or after a Preparing to Install failure that requests a restart.\r\n/RESTARTEXITCODE=exit code\r\nSpecifies a custom exit code that Setup is to return when the system needs to be restarted.\r\n/CLOSEAPPLICATIONS\r\nInstructs Setup to close applications using files that need to be updated.\r\n/NOCLOSEAPPLICATIONS\r\nPrevents Setup from closing applications using files that need to be updated.\r\n/RESTARTAPPLICATIONS\r\nInstructs Setup to restart applications.\r\n/NORESTARTAPPLICATIONS\r\nPrevents Setup from restarting applications.\r\n/LOADINF=\"filename\"\r\nInstructs Setup to load the settings from the specified file after having checked the command line.\r\n/SAVEINF=\"filename\"\r\nInstructs Setup to save installation settings to the specified file.\r\n/LANG=language\r\nSpecifies the internal name of the language to use.\r\n/DIR=\"x:\\dirname\"\r\nOverrides the default directory name.\r\n/GROUP=\"folder name\"\r\nOverrides the default folder name.\r\n/NOICONS\r\nInstructs Setup to initially check the Don\'t create a Start Menu folder check box.\r\n/TYPE=type name\r\nOverrides the default setup type.\r\n/COMPONENTS=\"comma separated list of component names\"\r\nOverrides the default component settings.\r\n/TASKS=\"comma separated list of task names\"\r\nSpecifies a list of tasks that should be initially selected.\r\n/MERGETASKS=\"comma separated list of task names\"\r\nLike the /TASKS parameter, except the specified tasks will be merged with the set of tasks that would have otherwise been selected by default.\r\n/PASSWORD=password\r\nSpecifies the password to use.\r\n\r\nFor more detailed information, please visit http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline",  *[fs:eax]);
				MessageBoxW(0, E00404D24(_v8), L"Setup", 0x10);
				_t17 = 0x40eecd;
				 *[fs:eax] = _t17;
				_push(E0040EED4);
				return L00404C88( &_v8);
			}

0x0040ee83
0x0040ee87
0x0040ee90
0x0040ee9b
0x0040eeb2
0x0040eeb9
0x0040eebc
0x0040eebf
0x0040eecc

APIs

MessageBoxW.USER32(00000000,00000000,Setup,00000010), ref: 0040EEB2

Strings

The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will in, xrefs: 0040EE96
Setup, xrefs: 0040EEA2

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: Message
String ID: Setup$The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will in
API String ID: 2030045667-2353098591
Opcode ID: dcd97cb552f07b45b344a2026074aa270ce0603171abd779e3f6b777d6616d79
Instruction ID: 995bee779b79db812177bc63803f14360cc09a7cbcdbd2e1f11c8b039434117f
Opcode Fuzzy Hash: dcd97cb552f07b45b344a2026074aa270ce0603171abd779e3f6b777d6616d79
Instruction Fuzzy Hash: B9E06574248208AEF701F653DD13F59769CD788B04F624877F900B19C1DA795E109459

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABF8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ABF8() {
				void* __ebx;
				struct HINSTANCE__* _t1;
				void* _t4;

				_t1 = GetModuleHandleW(L"kernel32.dll");
				_t3 = _t1;
				if(_t1 != 0) {
					_t1 = E00406728(_t3, _t4, _t3, L"GetDiskFreeSpaceExW");
					 *0x412810 = _t1;
				}
				if( *0x412810 == 0) {
					 *0x412810 = E00408068;
					return E00408068;
				}
				return _t1;
			}

0x0040abfe
0x0040ac03
0x0040ac07
0x0040ac0f
0x0040ac14
0x0040ac14
0x0040ac20
0x0040ac27
0x00000000
0x0040ac27
0x0040ac2d

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00411620,00000000,00411633), ref: 0040ABFE

Part of subcall function 00406728: GetProcAddress.KERNEL32(?,0040BDAE), ref: 0040674C

Strings

GetDiskFreeSpaceExW, xrefs: 0040AC09
kernel32.dll, xrefs: 0040ABF9

Memory Dump Source

Source File: 00000001.00000002.496164865.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.496149736.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496189967.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496227253.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.496247085.000000000041C000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496317987.0000000000452000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.496348270.0000000000456000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: fe33998cc9cc36d521a582d18847cefbb746d69cd43996148563fe781e2b6cb8
Instruction ID: caf3bee2458b42963bc9357fb50682e39eca259f80fc94b3950681cf825eb87a
Opcode Fuzzy Hash: fe33998cc9cc36d521a582d18847cefbb746d69cd43996148563fe781e2b6cb8
Instruction Fuzzy Hash: 77D05E713083014FE3007BB06E8160A25C8A301309B029A3BA401B62D2C7FD4835875E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 3yYh0IvfZPkSsqrl.tmp PID: 3008 Parent PID: 6128 3yYh0IvfZPkSsqrl.tmpCOMMON

Executed Functions

Function 00408370, Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 207
registrystringlibraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00408370(WCHAR* __eax) {
				WCHAR* _v8;
				void* _v12;
				short _v18;
				short _v22;
				short _v32;
				int _v36;
				short _v558;
				long _t48;
				signed int _t58;
				long _t67;
				long _t69;
				long _t71;
				WCHAR* _t82;
				struct HINSTANCE__* _t89;
				struct HINSTANCE__* _t96;
				short* _t108;
				WCHAR* _t109;
				intOrPtr _t113;
				signed int _t115;
				signed int _t116;
				signed int _t118;
				signed int _t119;
				signed int _t121;
				signed int _t122;
				struct HINSTANCE__* _t124;
				void* _t127;
				void* _t129;
				intOrPtr _t130;
				long _t137;

				_t127 = _t129;
				_t130 = _t129 + 0xfffffdd4;
				_v8 = __eax;
				GetModuleFileNameW(0,  &_v558, 0x105);
				_v32 = 0;
				_t48 = RegOpenKeyExW(0x80000001, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v12); // executed
				if(_t48 == 0) {
					L4:
					_push(_t127);
					_push(0x4084a4);
					_push( *[fs:eax]);
					 *[fs:eax] = _t130;
					_v36 = 0xa;
					E00408174( &_v558, 0x105);
					if(RegQueryValueExW(_v12,  &_v558, 0, 0,  &_v32,  &_v36) != 0) {
						_t137 = RegQueryValueExW(_v12, E00408698, 0, 0,  &_v32,  &_v36);
						if(_t137 != 0) {
							_v32 = 0;
						}
					}
					_t58 = _v36 >> 1;
					if(_t137 < 0) {
						asm("adc eax, 0x0");
					}
					 *((short*)(_t127 + _t58 * 2 - 0x1c)) = 0;
					_pop(_t113);
					 *[fs:eax] = _t113;
					_push(E004084AB);
					return RegCloseKey(_v12);
				} else {
					_t67 = RegOpenKeyExW(0x80000002, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v12); // executed
					if(_t67 == 0) {
						goto L4;
					} else {
						_t69 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Locales", 0, 0xf0019,  &_v12); // executed
						if(_t69 == 0) {
							goto L4;
						} else {
							_t71 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Delphi\\Locales", 0, 0xf0019,  &_v12); // executed
							if(_t71 != 0) {
								lstrcpynW( &_v558, _v8, 0x105);
								GetLocaleInfoW(GetThreadLocale(), 3,  &_v22, 5); // executed
								_t124 = 0;
								if(_v558 != 0 && (_v22 != 0 || _v32 != 0)) {
									_t108 = lstrlenW( &_v558) + _t80 +  &_v558;
									while( *_t108 != 0x2e && _t108 !=  &_v558) {
										_t108 = _t108 - 2;
									}
									_t82 =  &_v558;
									if(_t108 != _t82) {
										_t109 = _t108 + 2;
										if(_v32 != 0) {
											_t121 = _t109 - _t82;
											_t122 = _t121 >> 1;
											if(_t121 < 0) {
												asm("adc edx, 0x0");
											}
											lstrcpynW(_t109,  &_v32, 0x105 - _t122);
											_t124 = LoadLibraryExW( &_v558, 0, 2);
										}
										if(_t124 == 0 && _v22 != 0) {
											_t115 = _t109 -  &_v558;
											_t116 = _t115 >> 1;
											if(_t115 < 0) {
												asm("adc edx, 0x0");
											}
											lstrcpynW(_t109,  &_v22, 0x105 - _t116);
											_t89 = LoadLibraryExW( &_v558, 0, 2); // executed
											_t124 = _t89;
											if(_t124 == 0) {
												_v18 = 0;
												_t118 = _t109 -  &_v558;
												_t119 = _t118 >> 1;
												if(_t118 < 0) {
													asm("adc edx, 0x0");
												}
												lstrcpynW(_t109,  &_v22, 0x105 - _t119);
												_t96 = LoadLibraryExW( &_v558, 0, 2); // executed
												_t124 = _t96;
											}
										}
									}
								}
								return _t124;
							} else {
								goto L4;
							}
						}
					}
				}
			}

0x00408371
0x00408373
0x0040837b
0x0040838c
0x00408391
0x004083ac
0x004083b3
0x00408413
0x00408415
0x00408416
0x0040841b
0x0040841e
0x00408421
0x00408433
0x00408456
0x00408472
0x00408474
0x00408476
0x00408476
0x00408474
0x0040847f
0x00408481
0x00408483
0x00408483
0x00408486
0x0040848f
0x00408492
0x00408495
0x004084a3
0x004083b5
0x004083ca
0x004083d1
0x00000000
0x004083d3
0x004083e8
0x004083ef
0x00000000
0x004083f1
0x00408406
0x0040840d
0x004084bb
0x004084ce
0x004084d3
0x004084dd
0x0040850b
0x00408512
0x0040850f
0x0040850f
0x00408522
0x0040852a
0x00408530
0x00408538
0x0040853c
0x0040853e
0x00408540
0x00408542
0x00408542
0x00408552
0x00408567
0x00408567
0x0040856b
0x0040857c
0x0040857e
0x00408580
0x00408582
0x00408582
0x00408592
0x004085a2
0x004085a7
0x004085ab
0x004085ad
0x004085bb
0x004085bd
0x004085bf
0x004085c1
0x004085c1
0x004085d1
0x004085e1
0x004085e6
0x004085e6
0x004085ab
0x0040856b
0x0040852a
0x004085ef
0x00000000
0x00000000
0x00000000
0x0040840d
0x004083ef
0x004083d1

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,?,00000000), ref: 0040838C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,?,00000000), ref: 004083AC
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,?,00000000), ref: 004083CA
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000), ref: 004083E8
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00408406
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,004084A4,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?), ref: 0040844F
RegQueryValueExW.ADVAPI32(?,00408698,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,004084A4,?,80000001), ref: 0040846D
RegCloseKey.ADVAPI32(?,004084AB,00000000,?,?,00000000,004084A4,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0040849E
lstrcpynW.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000), ref: 004084BB
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 004084C8
GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019), ref: 004084CE
lstrlenW.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 004084FC
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00408552
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00408562
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00408592
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 004085A2
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 004085D1

Strings

Software\Borland\Locales, xrefs: 004083DE
Software\CodeGear\Locales, xrefs: 004083A2, 004083C0
Software\Borland\Delphi\Locales, xrefs: 004083FC

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Openlstrcpyn$LibraryLoadLocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales
API String ID: 3838733197-345420546
Opcode ID: dafdfd18fb6c40a2d41f9fc4910561df257b48953a1921b5bcc087da3586443a
Instruction ID: a500898f6dc47257e1585acfd824c909a598bb48bb2a219c79c4edbb62c36863
Opcode Fuzzy Hash: dafdfd18fb6c40a2d41f9fc4910561df257b48953a1921b5bcc087da3586443a
Instruction Fuzzy Hash: 3B615271A402197AEB20DAE5CD46FEF72BC9B08704F44407BBA40F65C1FABC9A448B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00480084, Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 178
memoryCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00480084(long __eax) {
				signed char _v5;
				void* _v12;
				char _v16;
				void* _v20;
				long _v24;
				void* _v28;
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr* _t36;
				void* _t85;
				signed int _t96;
				intOrPtr _t101;
				intOrPtr _t102;
				void* _t103;
				void* _t106;
				void* _t107;
				void* _t109;
				void* _t111;
				intOrPtr _t112;

				_t109 = _t111;
				_t112 = _t111 + 0xffffffe8;
				_push(_t103);
				_t36 =  *0x50605c; // 0x503914
				if( *_t36 == 2) {
					_v5 = 0;
					if(AllocateAndInitializeSid(0x504dd4, 2, 0x20, __eax, 0, 0, 0, 0, 0, 0,  &_v12) == 0) {
						goto L26;
					} else {
						_push(_t109);
						_push(0x480268);
						_push( *[fs:eax]);
						 *[fs:eax] = _t112;
						_t95 = 0;
						if((GetVersion() & 0x000000ff) >= 5) {
							_t95 = E00409620(0, _t103, GetModuleHandleW(L"advapi32.dll"), L"CheckTokenMembership");
						}
						if(_t95 == 0) {
							_v28 = 0;
							if(OpenThreadToken(GetCurrentThread(), 8, 0xffffffff,  &_v20) != 0) {
								L13:
								_push(_t109);
								_push(0x48024a);
								_push( *[fs:eax]);
								 *[fs:eax] = _t112;
								_v24 = 0;
								if(GetTokenInformation(_v20, 2, 0, 0,  &_v24) != 0 || GetLastError() == 0x7a) {
									_v28 = E00403018(_v24);
									if(GetTokenInformation(_v20, 2, _v28, _v24,  &_v24) != 0) {
										_t106 =  *_v28 - 1;
										if(_t106 >= 0) {
											_t107 = _t106 + 1;
											_t96 = 0;
											while(EqualSid(_v12,  *(_v28 + 4 + _t96 * 8)) == 0 || ( *(_v28 + 8 + _t96 * 8) & 0x00000014) != 4) {
												_t96 = _t96 + 1;
												_t107 = _t107 - 1;
												if(_t107 != 0) {
													continue;
												}
												goto L24;
											}
											_v5 = 1;
										}
										L24:
										_pop(_t101);
										 *[fs:eax] = _t101;
										_push(E00480251);
										E00403034(_v28);
										return CloseHandle(_v20);
									} else {
										E00404B68();
										E00404B68();
										goto L26;
									}
								} else {
									E00404B68();
									E00404B68();
									goto L26;
								}
							} else {
								if(GetLastError() == 0x3f0) {
									if(OpenProcessToken(GetCurrentProcess(), 8,  &_v20) != 0) {
										goto L13;
									} else {
										E00404B68();
										goto L26;
									}
								} else {
									E00404B68();
									goto L26;
								}
							}
						} else {
							_t85 =  *_t95(0, _v12,  &_v16); // executed
							if(_t85 != 0) {
								asm("sbb eax, eax");
								_v5 = _t85 + 1;
							}
							_pop(_t102);
							 *[fs:eax] = _t102;
							_push(E0048026F);
							return FreeSid(_v12);
						}
					}
				} else {
					_v5 = 1;
					L26:
					return _v5 & 0x000000ff;
				}
			}

0x00480085
0x00480087
0x0048008b
0x0048008e
0x00480096
0x004800a1
0x004800c6
0x00000000
0x004800cc
0x004800ce
0x004800cf
0x004800d4
0x004800d7
0x004800da
0x004800ea
0x00480101
0x00480101
0x00480105
0x0048012c
0x00480144
0x0048017b
0x0048017d
0x0048017e
0x00480183
0x00480186
0x0048018b
0x004801a3
0x004801c6
0x004801e2
0x004801f5
0x004801f8
0x004801fa
0x004801fb
0x004801fd
0x00480227
0x00480228
0x00480229
0x00000000
0x00000000
0x00000000
0x00480229
0x00480221
0x00480221
0x0048022b
0x0048022d
0x00480230
0x00480233
0x0048023b
0x00480249
0x004801e4
0x004801e4
0x004801e9
0x00000000
0x004801e9
0x004801af
0x004801af
0x004801b4
0x00000000
0x004801b4
0x00480146
0x00480150
0x0048016f
0x00000000
0x00480171
0x00480171
0x00000000
0x00480171
0x00480152
0x00480152
0x00000000
0x00480152
0x00480150
0x00480107
0x00480111
0x00480115
0x0048011f
0x00480122
0x00480122
0x00480253
0x00480256
0x00480259
0x00480267
0x00480267
0x00480105
0x00480098
0x00480098
0x0048026f
0x00480278
0x00480278

APIs

AllocateAndInitializeSid.ADVAPI32(00504DD4,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004800BF
GetVersion.KERNEL32(00000000,00480268,?,00504DD4,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004800DC
GetModuleHandleW.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,00480268,?,00504DD4,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004800F6
FreeSid.ADVAPI32(00000000,0048026F,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00480262

Strings

advapi32.dll, xrefs: 004800F1
CheckTokenMembership, xrefs: 004800EC

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateFreeHandleInitializeModuleVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4173726493-1888249752
Opcode ID: 2833973f6580e6490c430e90fc9ca9576ccb935c71bb72afced4c6d511dc9984
Instruction ID: ec4f118b8524ed7e9f691ed80ccbccf3c901710795354cf287df2ab2ac6a93c7
Opcode Fuzzy Hash: 2833973f6580e6490c430e90fc9ca9576ccb935c71bb72afced4c6d511dc9984
Instruction Fuzzy Hash: A6518171A54305AADB91FAF58C46BAF76A8AB48704F10086BBA00F21C2D67DDD48876D

Uniqueness

Uniqueness Score: -1.00%

Function 00473790, Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 381
windowCOMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00473790(intOrPtr __eax, struct HWND__** __edx, void* __fp0) {
				intOrPtr _v8;
				int _v12;
				intOrPtr _v16;
				struct HDC__* _v20;
				char _v21;
				struct HWND__* _v28;
				void* __ebp;
				struct HWND__* _t111;
				intOrPtr _t123;
				struct HWND__* _t124;
				intOrPtr _t128;
				intOrPtr _t129;
				intOrPtr _t149;
				intOrPtr _t151;
				intOrPtr _t152;
				int _t155;
				intOrPtr _t158;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				struct HWND__* _t165;
				struct HWND__* _t168;
				intOrPtr _t174;
				intOrPtr _t204;
				intOrPtr _t232;
				struct HWND__* _t235;
				struct HWND__** _t237;
				void* _t240;
				struct HWND__* _t259;
				struct HWND__* _t261;
				struct HWND__* _t264;
				struct HWND__* _t265;
				void* _t279;
				void* _t280;
				intOrPtr _t286;
				void* _t288;
				intOrPtr _t294;
				intOrPtr _t298;
				struct HWND__* _t304;
				struct HWND__* _t307;
				intOrPtr _t310;
				struct HWND__* _t311;
				struct HWND__* _t314;
				struct HWND__* _t315;
				struct HWND__* _t316;
				struct HWND__* _t321;
				struct HWND__* _t322;
				struct HWND__* _t323;
				struct HWND__* _t324;
				void* _t326;
				void* _t328;
				intOrPtr _t329;
				void* _t331;
				void* _t336;

				_t326 = _t328;
				_t329 = _t328 + 0xffffffe8;
				_t237 = __edx;
				_v8 = __eax;
				_t111 =  *__edx;
				_t259 = _t111;
				_t331 = _t259 - 0x112;
				if(_t331 > 0) {
					_t261 = _t259 + 0xfffffce2 - 2;
					__eflags = _t261;
					if(_t261 < 0) {
						E00478B98(_v8, _t240, __fp0);
					} else {
						_t264 = _t261 - 0xacfa;
						__eflags = _t264;
						if(_t264 == 0) {
							__eflags =  *(_v8 + 0x90);
							if(__eflags != 0) {
								E004042A8(_v8, __eflags);
							}
						} else {
							_t265 = _t264 - 1;
							__eflags = _t265;
							if(_t265 == 0) {
								__eflags =  *(_v8 + 0x90);
								if(__eflags != 0) {
									E004042A8(_v8, __eflags);
								}
							} else {
								__eflags = _t265 == 0x2c;
								if(_t265 == 0x2c) {
									_t321 = __edx[1];
									_t314 = 0;
									while(1) {
										__eflags = _t321;
										if(_t321 == 0) {
											break;
										}
										__eflags = _t314;
										if(_t314 == 0) {
											_t314 = E00457908(_t321, _t240);
											_t321 = GetParent(_t321);
											continue;
										}
										break;
									}
									__eflags = _t314;
									if(_t314 != 0) {
										_t322 = E00471140(_t314);
										_t123 = _v8;
										__eflags = _t314 -  *((intOrPtr*)(_t123 + 0x278));
										if(_t314 !=  *((intOrPtr*)(_t123 + 0x278))) {
											L37:
											__eflags = _t322;
											if(_t322 != 0) {
												__eflags = _t322 - _v8;
												if(_t322 == _v8) {
													L40:
													_t124 =  *(_t322 + 0x278);
													__eflags = _t124;
													if(_t124 != 0) {
														__eflags = _t314 - _t124;
														if(_t314 != _t124) {
															__eflags = 0;
															E0045C4F0(_t124, 0, 8, 0);
														}
													}
													 *((intOrPtr*)(_t322->i + 0xfc))();
												} else {
													_t128 =  *0x50c180; // 0x0
													__eflags = _t322 -  *((intOrPtr*)(_t128 + 0x60));
													if(_t322 !=  *((intOrPtr*)(_t128 + 0x60))) {
														goto L40;
													}
												}
											}
										} else {
											_t129 =  *0x50c180; // 0x0
											__eflags = _t314 -  *((intOrPtr*)(_t129 + 0x5c));
											if(_t314 !=  *((intOrPtr*)(_t129 + 0x5c))) {
												goto L37;
											}
										}
									}
								} else {
									goto L66;
								}
							}
						}
					}
					goto L68;
				} else {
					if(_t331 == 0) {
						__eflags = (__edx[1] & 0x0000fff0) - 0xf120;
						if((__edx[1] & 0x0000fff0) == 0xf120) {
							L15:
							_t149 =  *0x50c17c; // 0x0
							__eflags =  *((intOrPtr*)(_t149 + 0x40)) - _v8;
							if( *((intOrPtr*)(_t149 + 0x40)) != _v8) {
								goto L68;
							} else {
								_t151 =  *0x50c17c; // 0x0
								__eflags =  *((char*)(_t151 + 0xcf));
								if( *((char*)(_t151 + 0xcf)) == 0) {
									goto L68;
								} else {
									_t152 =  *0x50c17c; // 0x0
									_t155 = IsIconic(E00463AA8( *((intOrPtr*)(_t152 + 0x40))));
									__eflags = _t155 - 1;
									asm("sbb eax, eax");
									_v21 = _t155 + 1;
									_t111 = E004608E0(_v8, _t237);
									__eflags = _v21;
									if(_v21 != 0) {
										_t158 =  *0x50c17c; // 0x0
										_t111 = E0047E038(_t158, _t240);
									}
								}
							}
						} else {
							__eflags = (__edx[1] & 0x0000fff0) - 0xf030;
							if((__edx[1] & 0x0000fff0) != 0xf030) {
								goto L68;
							} else {
								_t161 =  *0x50c17c; // 0x0
								__eflags =  *((char*)(_t161 + 0x30));
								if( *((char*)(_t161 + 0x30)) == 0) {
									goto L68;
								} else {
									goto L15;
								}
							}
						}
						goto L69;
					} else {
						_t279 = _t259 + 0xfffffffa - 3;
						if(_t279 < 0) {
							__eflags =  *0x504c9c;
							if( *0x504c9c != 0) {
								__eflags =  *__edx - 7;
								if( *__edx != 7) {
									goto L68;
								} else {
									_t162 = _v8;
									__eflags =  *(_t162 + 0x1c) & 0x00000010;
									if(( *(_t162 + 0x1c) & 0x00000010) != 0) {
										goto L68;
									} else {
										_t323 = 0;
										_t163 = _v8;
										__eflags =  *((char*)(_t163 + 0x287)) - 2;
										if( *((char*)(_t163 + 0x287)) != 2) {
											_t165 =  *(_v8 + 0x278);
											__eflags = _t165;
											if(_t165 != 0) {
												__eflags = _t165 - _v8;
												if(_t165 != _v8) {
													_t323 = E00463AA8(_t165);
												}
											}
										} else {
											_t168 = E004746F4(_v8);
											__eflags = _t168;
											if(_t168 != 0) {
												_t323 = E00463AA8(E004746F4(_v8));
											}
										}
										__eflags = _t323;
										if(_t323 == 0) {
											goto L68;
										} else {
											_t111 = SetFocus(_t323);
										}
									}
								}
							}
							goto L69;
						} else {
							_t280 = _t279 - 0x22;
							if(_t280 == 0) {
								_v28 = __edx[2];
								__eflags = _v28->i - 1;
								if(_v28->i != 1) {
									goto L68;
								} else {
									_t174 = _v8;
									__eflags =  *(_t174 + 0x2a0);
									if( *(_t174 + 0x2a0) == 0) {
										goto L68;
									} else {
										_t315 = E004525E0( *((intOrPtr*)(_v8 + 0x2a0)), 0,  *((intOrPtr*)(_v28 + 8)));
										__eflags = _t315;
										if(_t315 == 0) {
											goto L68;
										} else {
											_v16 = E004318E0(0, 1);
											_push(_t326);
											_push(0x473b5f);
											_push( *[fs:eax]);
											 *[fs:eax] = _t329;
											_v12 = SaveDC( *(_v28 + 0x18));
											_push(_t326);
											_push(0x473b42);
											_push( *[fs:eax]);
											 *[fs:eax] = _t329;
											E00432674(_v16,  *(_v28 + 0x18));
											E00432508(_v16);
											E00453E80(_t315, _v28 + 0x1c, _v16,  *(_v28 + 0x10) & 0x0000ffff);
											_pop(_t286);
											 *[fs:eax] = _t286;
											_push(0x473b49);
											__eflags = 0;
											E00432674(_v16, 0);
											return RestoreDC( *(_v28 + 0x18), _v12);
										}
									}
								}
							} else {
								_t288 = _t280 - 1;
								if(_t288 == 0) {
									_t324 = __edx[2];
									__eflags = _t324->i - 1;
									if(_t324->i != 1) {
										goto L68;
									} else {
										_t204 = _v8;
										__eflags =  *(_t204 + 0x2a0);
										if( *(_t204 + 0x2a0) == 0) {
											goto L68;
										} else {
											_t316 = E004525E0( *((intOrPtr*)(_v8 + 0x2a0)), 0,  *((intOrPtr*)(_t324 + 8)));
											__eflags = _t316;
											if(_t316 == 0) {
												goto L68;
											} else {
												_v20 = GetWindowDC(E00463AA8(_v8));
												 *[fs:eax] = _t329;
												_v16 = E004318E0(0, 1);
												 *[fs:eax] = _t329;
												_v12 = SaveDC(_v20);
												 *[fs:eax] = _t329;
												E00432674(_v16, _v20);
												E00432508(_v16);
												 *((intOrPtr*)(_t316->i + 0x38))(_t324 + 0x10,  *[fs:eax], 0x473c49, _t326,  *[fs:eax], 0x473c66, _t326,  *[fs:eax], 0x473c8d, _t326);
												_pop(_t294);
												 *[fs:eax] = _t294;
												_push(0x473c50);
												__eflags = 0;
												E00432674(_v16, 0);
												return RestoreDC(_v20, _v12);
											}
										}
									}
								} else {
									if(_t288 == 0x1a) {
										_t232 = _v8;
										__eflags = ( *0x473d34 & 0x0000ffff) - ( *(_t232 + 0x1c) & 0x0000ffff &  *0x473d30);
										if(( *0x473d34 & 0x0000ffff) == ( *(_t232 + 0x1c) & 0x0000ffff &  *0x473d30)) {
											_t235 = __edx[2];
											_t298 = _v8;
											__eflags = ( *(_t298 + 0x288) & 0x000000ff) - 0xffffffffffffffff;
											if(( *(_t298 + 0x288) & 0x000000ff) - 0xffffffffffffffff < 0) {
												_t310 = _v8;
												__eflags =  *((char*)(_t310 + 0x283)) - 2;
												if( *((char*)(_t310 + 0x283)) != 2) {
													_t311 = _t235;
													_t44 = _t311 + 0x18;
													 *_t44 =  *(_t311 + 0x18) | 0x00000002;
													__eflags =  *_t44;
												}
											}
											_t304 = ( *(_v8 + 0x288) & 0x000000ff) - 1;
											__eflags = _t304;
											if(_t304 == 0) {
												L54:
												_t307 = ( *(_v8 + 0x281) & 0x000000ff) - 2;
												__eflags = _t307;
												if(_t307 == 0) {
													L56:
													 *(_t235 + 0x18) =  *(_t235 + 0x18) | 0x00000001;
												} else {
													__eflags = _t307 == 3;
													if(_t307 == 3) {
														goto L56;
													}
												}
											} else {
												__eflags = _t304 == 2;
												if(_t304 == 2) {
													goto L54;
												}
											}
										}
									} else {
										L66:
										_t336 = _t111 -  *0x50c188; // 0xc075
										if(_t336 == 0) {
											E0045C4F0(_v8, 0, 0xb025, 0);
											E0045C4F0(_v8, 0, 0xb024, 0);
											E0045C4F0(_v8, 0, 0xb035, 0);
											E0045C4F0(_v8, 0, 0xb009, 0);
											E0045C4F0(_v8, 0, 0xb008, 0);
											E0045C4F0(_v8, 0, 0xb03d, 0);
											E0045C4F0(_v8, 0, 0xb050, 0);
										}
									}
									L68:
									_t111 = E004608E0(_v8, _t237); // executed
									L69:
									return _t111;
								}
							}
						}
					}
				}
			}

0x00473791
0x00473793
0x00473799
0x0047379b
0x0047379e
0x004737a0
0x004737a2
0x004737a8
0x004737dc
0x004737dc
0x004737df
0x00473c99
0x004737e5
0x004737e5
0x004737e5
0x004737eb
0x004739cb
0x004739d2
0x004739df
0x004739df
0x004737f1
0x004737f1
0x004737f1
0x004737f2
0x004739aa
0x004739b1
0x004739be
0x004739be
0x004737f8
0x004737f8
0x004737fb
0x00473913
0x00473916
0x0047392b
0x0047392b
0x0047392d
0x00000000
0x00000000
0x0047392f
0x00473931
0x00473921
0x00473929
0x00000000
0x00473929
0x00000000
0x00473931
0x00473933
0x00473935
0x00473944
0x00473946
0x00473949
0x0047394f
0x0047395f
0x0047395f
0x00473961
0x00473967
0x0047396a
0x0047397a
0x0047397a
0x00473980
0x00473982
0x00473984
0x00473986
0x0047398a
0x00473991
0x00473991
0x00473986
0x0047399c
0x0047396c
0x0047396c
0x00473971
0x00473974
0x00000000
0x00000000
0x00473974
0x0047396a
0x00473951
0x00473951
0x00473956
0x00473959
0x00000000
0x00000000
0x00473959
0x0047394f
0x00473801
0x00000000
0x00473801
0x004737fb
0x004737f2
0x004737eb
0x00000000
0x004737aa
0x004737aa
0x0047380e
0x00473813
0x00473837
0x00473837
0x0047383f
0x00473842
0x00000000
0x00473848
0x00473848
0x0047384d
0x00473854
0x00000000
0x0047385a
0x0047385a
0x00473868
0x0047386d
0x00473870
0x00473873
0x0047387b
0x00473880
0x00473884
0x0047388a
0x0047388f
0x0047388f
0x00473884
0x00473854
0x00473815
0x0047381d
0x00473822
0x00000000
0x00473828
0x00473828
0x0047382d
0x00473831
0x00000000
0x00000000
0x00000000
0x00000000
0x00473831
0x00473822
0x00000000
0x004737ac
0x004737af
0x004737b2
0x00473899
0x004738a0
0x004738a6
0x004738a9
0x00000000
0x004738af
0x004738af
0x004738b2
0x004738b6
0x00000000
0x004738bc
0x004738bc
0x004738be
0x004738c1
0x004738c8
0x004738ea
0x004738f0
0x004738f2
0x004738f4
0x004738f7
0x004738fe
0x004738fe
0x004738f7
0x004738ca
0x004738cd
0x004738d2
0x004738d4
0x004738e3
0x004738e3
0x004738d4
0x00473900
0x00473902
0x00000000
0x00473908
0x00473909
0x00473909
0x00473902
0x004738b6
0x004738a9
0x00000000
0x004737b8
0x004737b8
0x004737bb
0x00473a68
0x00473a6e
0x00473a71
0x00000000
0x00473a77
0x00473a77
0x00473a7a
0x00473a81
0x00000000
0x00473a87
0x00473a9d
0x00473a9f
0x00473aa1
0x00000000
0x00473aa7
0x00473ab3
0x00473ab8
0x00473ab9
0x00473abe
0x00473ac1
0x00473ad0
0x00473ad5
0x00473ad6
0x00473adb
0x00473ade
0x00473aea
0x00473afd
0x00473b15
0x00473b1c
0x00473b1f
0x00473b22
0x00473b27
0x00473b2c
0x00473b41
0x00473b41
0x00473aa1
0x00473a81
0x004737c1
0x004737c1
0x004737c2
0x00473b66
0x00473b69
0x00473b6c
0x00000000
0x00473b72
0x00473b72
0x00473b75
0x00473b7c
0x00000000
0x00473b82
0x00473b95
0x00473b97
0x00473b99
0x00000000
0x00473b9f
0x00473bad
0x00473bbb
0x00473bca
0x00473bd8
0x00473be4
0x00473bf2
0x00473bfb
0x00473c0e
0x00473c21
0x00473c26
0x00473c29
0x00473c2c
0x00473c31
0x00473c36
0x00473c48
0x00473c48
0x00473b99
0x00473b7c
0x004737c8
0x004737cb
0x004739e9
0x004739fe
0x00473a01
0x00473a07
0x00473a0a
0x00473a15
0x00473a18
0x00473a1a
0x00473a1d
0x00473a24
0x00473a26
0x00473a28
0x00473a28
0x00473a28
0x00473a28
0x00473a24
0x00473a36
0x00473a36
0x00473a39
0x00473a44
0x00473a4e
0x00473a4e
0x00473a51
0x00473a5c
0x00473a5c
0x00473a53
0x00473a53
0x00473a56
0x00000000
0x00000000
0x00473a56
0x00473a3b
0x00473a3b
0x00473a3e
0x00000000
0x00000000
0x00473a3e
0x00473a39
0x004737d1
0x00473ca0
0x00473ca0
0x00473ca6
0x00473cb4
0x00473cc5
0x00473cd6
0x00473ce7
0x00473cf8
0x00473d09
0x00473d1a
0x00473d1a
0x00473ca6
0x00473d1f
0x00473d24
0x00473d29
0x00473d2f
0x00473d2f
0x004737c2
0x004737bb
0x004737b2
0x004737aa

APIs

IsIconic.USER32(00000000), ref: 00473868
SetFocus.USER32(00000000), ref: 00473909
SaveDC.GDI32(?,00000000,00473B5F), ref: 00473ACB
RestoreDC.GDI32(?,?,00473B49,?,?,00000000,00473B5F), ref: 00473B3C
GetWindowDC.USER32(00000000), ref: 00473BA8
SaveDC.GDI32(?,00000000,00473C66,?,00000000,00473C8D,?,00000000), ref: 00473BDF
RestoreDC.GDI32(?,?,00473C50,00473C66,?,00000000,00473C8D,?,00000000), ref: 00473C43

Strings

@IE, xrefs: 00473AA9, 00473BC0

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: RestoreSave$FocusIconicWindow
String ID: @IE
API String ID: 1400084646-2832602497
Opcode ID: e5a808d70f57538961e0a943c4d67c496c9d43fe67fc2f1abff95c5e1b59f0e7
Instruction ID: 568260baaf041bc14af473cf6e50df23c1365b1a6c390616beee2fd90e12b2be
Opcode Fuzzy Hash: e5a808d70f57538961e0a943c4d67c496c9d43fe67fc2f1abff95c5e1b59f0e7
Instruction Fuzzy Hash: 9DE1C571A00104DFDB20DF69C586AEE77F6AF45305F2581A6E5099B752CB38EF40EB48

Uniqueness

Uniqueness Score: -1.00%

Function 004084AB, Relevance: 15.1, APIs: 10, Instructions: 108
stringlibrarythreadCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004084AB() {
				void* _t32;
				struct HINSTANCE__* _t39;
				struct HINSTANCE__* _t46;
				short* _t57;
				WCHAR* _t58;
				signed int _t60;
				signed int _t61;
				signed int _t63;
				signed int _t64;
				signed int _t66;
				signed int _t67;
				struct HINSTANCE__* _t68;
				void* _t70;

				lstrcpynW(_t70 - 0x22a,  *(_t70 - 4), 0x105);
				GetLocaleInfoW(GetThreadLocale(), 3, _t70 - 0x12, 5); // executed
				_t68 = 0;
				if( *(_t70 - 0x22a) == 0 ||  *(_t70 - 0x12) == 0 &&  *(_t70 - 0x1c) == 0) {
					L20:
					return _t68;
				} else {
					_t57 = lstrlenW(_t70 - 0x22a) + _t30 + _t70 - 0x22a;
					L5:
					if( *_t57 != 0x2e && _t57 != _t70 - 0x22a) {
						_t57 = _t57 - 2;
						goto L5;
					}
					_t32 = _t70 - 0x22a;
					if(_t57 != _t32) {
						_t58 = _t57 + 2;
						if( *(_t70 - 0x1c) != 0) {
							_t66 = _t58 - _t32;
							_t67 = _t66 >> 1;
							if(_t66 < 0) {
								asm("adc edx, 0x0");
							}
							lstrcpynW(_t58, _t70 - 0x1c, 0x105 - _t67);
							_t68 = LoadLibraryExW(_t70 - 0x22a, 0, 2);
						}
						if(_t68 == 0 &&  *(_t70 - 0x12) != 0) {
							_t60 = _t58 - _t70 - 0x22a;
							_t61 = _t60 >> 1;
							if(_t60 < 0) {
								asm("adc edx, 0x0");
							}
							lstrcpynW(_t58, _t70 - 0x12, 0x105 - _t61);
							_t39 = LoadLibraryExW(_t70 - 0x22a, 0, 2); // executed
							_t68 = _t39;
							if(_t68 == 0) {
								 *((short*)(_t70 - 0xe)) = 0;
								_t63 = _t58 - _t70 - 0x22a;
								_t64 = _t63 >> 1;
								if(_t63 < 0) {
									asm("adc edx, 0x0");
								}
								lstrcpynW(_t58, _t70 - 0x12, 0x105 - _t64);
								_t46 = LoadLibraryExW(_t70 - 0x22a, 0, 2); // executed
								_t68 = _t46;
							}
						}
					}
					goto L20;
				}
			}

0x004084bb
0x004084ce
0x004084d3
0x004084dd
0x004085e8
0x004085ef
0x004084f5
0x0040850b
0x00408512
0x00408516
0x0040850f
0x00000000
0x0040850f
0x00408522
0x0040852a
0x00408530
0x00408538
0x0040853c
0x0040853e
0x00408540
0x00408542
0x00408542
0x00408552
0x00408567
0x00408567
0x0040856b
0x0040857c
0x0040857e
0x00408580
0x00408582
0x00408582
0x00408592
0x004085a2
0x004085a7
0x004085ab
0x004085ad
0x004085bb
0x004085bd
0x004085bf
0x004085c1
0x004085c1
0x004085d1
0x004085e1
0x004085e6
0x004085e6
0x004085ab
0x0040856b
0x00000000
0x0040852a

APIs

lstrcpynW.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000), ref: 004084BB
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 004084C8
GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019), ref: 004084CE
lstrlenW.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 004084FC
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00408552
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00408562
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00408592
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 004085A2
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 004085D1
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?), ref: 004085E1

Strings

Software\Borland\Locales, xrefs: 004083DE
Software\CodeGear\Locales, xrefs: 004083A2, 004083C0
Software\Borland\Delphi\Locales, xrefs: 004083FC

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales
API String ID: 1599918012-345420546
Opcode ID: 4178ec917de22c9fa02476d0238962d15125bf17bcff0688646d60131478852f
Instruction ID: 2bdfecea2a4ebc7d9a87a4a5d20900cc82af348492f95972f04b7fe5743583f5
Opcode Fuzzy Hash: 4178ec917de22c9fa02476d0238962d15125bf17bcff0688646d60131478852f
Instruction Fuzzy Hash: 9B319671E0011976EB21DAE4DD49BEF62BC9B08304F44417BE540F76C1FABC9E448B59

Uniqueness

Uniqueness Score: -1.00%

Function 00470B44, Relevance: 12.1, APIs: 8, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC,00000000,?,?,?,0047C681,?,?), ref: 00470B52
IsIconic.USER32(?,?,000000EC,00000000,?,?,?,0047C681,?,?), ref: 00470B80
IsWindowVisible.USER32(?,?,?,000000EC,00000000,?,?,?,0047C681,?,?), ref: 00470B90
ShowWindow.USER32(?,00000000,?,?,?,000000EC,00000000,?,?,?,0047C681,?,?), ref: 00470BAD
SetWindowLongW.USER32(?,000000EC,00000000,?,?,?,000000EC,00000000,?,?,?,0047C681,?,?), ref: 00470BC0
SetWindowLongW.USER32(?,000000EC,00000000,?,?,?,000000EC,00000000,?,?,?,0047C681,?,?), ref: 00470BD1
ShowWindow.USER32(?,00000006,?,000000EC,00000000,?,?,?,000000EC,00000000,?,?,?,0047C681,?,?), ref: 00470BF1
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,?,?,000000EC,00000000,?,?,?,0047C681,?,?), ref: 00470BFB

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$LongShow$IconicVisible
String ID:
API String ID: 3484284227-0
Opcode ID: 6111dc82254c08d5bcaee5b8df1e49ad71534e3faa66ae7d7f93a9c38886f6ec
Instruction ID: a81edc390d7f4f5f644ee434172eecc44a95f8e7c7f0e1f070a512e7138a3473
Opcode Fuzzy Hash: 6111dc82254c08d5bcaee5b8df1e49ad71534e3faa66ae7d7f93a9c38886f6ec
Instruction Fuzzy Hash: 8411861254F69068E626766A4C02FEF1A984F93319F28866FF5D8E12C3C23D9A45816F

Uniqueness

Uniqueness Score: -1.00%

Function 004CCDB4, Relevance: 3.1, APIs: 2, Instructions: 52comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004CCE4A,?,00000000,00000000,?,004CCE60,?,004EAAC7), ref: 004CCDD1
CoCreateInstance.OLE32(005053F8,00000000,00000001,00505408,00000000,00000000,004CCE4A,?,00000000,00000000,?,004CCE60,?,004EAAC7), ref: 004CCDF7

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateInstanceVersion
String ID:
API String ID: 1462612201-0
Opcode ID: 09f5832fede5504c8366273324d476e878253c9dae48a426b32fb2f6e1467413
Instruction ID: 530fd3f7a62a5a6c6be5275be5bda9362e78bf0aec1b5113b2b99c1747515e3b
Opcode Fuzzy Hash: 09f5832fede5504c8366273324d476e878253c9dae48a426b32fb2f6e1467413
Instruction Fuzzy Hash: B2112235604240AFDB40EB68DD85F6E7BECEB06300FA1407AF104DB2A1D778AD04DB18

Uniqueness

Uniqueness Score: -1.00%

Function 004AD600, Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,004AD663,?,00000000,?), ref: 004AD63D
GetLastError.KERNEL32(00000000,?,00000000,004AD663,?,00000000,?), ref: 004AD645

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 808384640a3d10c3b7f3debaea33ab5737e30175ad0972cf19fc7d048ccd84ef
Instruction ID: eb2b26bc8f525a5a4bc618b1c84346648ae5fde1d7e232dae534d469ce73c9a6
Opcode Fuzzy Hash: 808384640a3d10c3b7f3debaea33ab5737e30175ad0972cf19fc7d048ccd84ef
Instruction Fuzzy Hash: E9F02D31E042086BCB10DFB69C0189EF7ACDB5772475146BBF819E3A81DA784E00829C

Uniqueness

Uniqueness Score: -1.00%

Function 0045C61C, Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2c25db103048f77565a65fbea6e00a0a4b57f4ce1cabf7155f179e6d4c57f4
Instruction ID: 9b3baeb67888a174e230ec835b2bf199f7cff69d412c6a3ed747ef88b01a190a
Opcode Fuzzy Hash: 3c2c25db103048f77565a65fbea6e00a0a4b57f4ce1cabf7155f179e6d4c57f4
Instruction Fuzzy Hash: E6818034600741CFC710EB2DC8C86AE77E5AF46706F54416AE845EB3A2C778DD89DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 004691D0, Relevance: 29.8, APIs: 4, Strings: 13, Instructions: 95
libraryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004691D0() {
				int _v8;
				void* __ebx;
				void* __ebp;
				intOrPtr _t4;
				int _t5;
				int _t9;
				intOrPtr _t11;
				intOrPtr _t13;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr _t25;
				intOrPtr _t27;
				intOrPtr _t29;
				intOrPtr _t39;
				void* _t40;
				intOrPtr _t42;
				intOrPtr _t44;

				_t42 = _t44;
				_push(_t33);
				_t4 =  *0x506078; // 0x509c54
				if( *((char*)(_t4 + 0xc)) == 0) {
					return _t4;
				} else {
					_t5 = SetErrorMode(0x8000); // executed
					_v8 = _t5;
					_push(_t42);
					_push(0x469336);
					_push( *[fs:eax]);
					 *[fs:eax] = _t44;
					if( *0x50c138 == 0) {
						_t33 = GetModuleHandleW(L"USER32");
						 *0x50c138 = E00409620(_t31, _t40, _t31, L"WINNLSEnableIME");
					}
					if( *0x504be4 == 0) {
						 *0x504be4 = LoadLibraryW(L"imm32.dll");
						if( *0x504be4 != 0) {
							_t11 =  *0x504be4; // 0x74a30000
							 *0x50c13c = E00409620(_t33, _t40, _t11, L"ImmGetContext");
							_t13 =  *0x504be4; // 0x74a30000
							 *0x50c140 = E00409620(_t33, _t40, _t13, L"ImmReleaseContext");
							_t15 =  *0x504be4; // 0x74a30000
							 *0x50c144 = E00409620(_t33, _t40, _t15, L"ImmGetConversionStatus");
							_t17 =  *0x504be4; // 0x74a30000
							 *0x50c148 = E00409620(_t33, _t40, _t17, L"ImmSetConversionStatus");
							_t19 =  *0x504be4; // 0x74a30000
							 *0x50c14c = E00409620(_t33, _t40, _t19, L"ImmSetOpenStatus");
							_t21 =  *0x504be4; // 0x74a30000
							 *0x50c150 = E00409620(_t33, _t40, _t21, L"ImmSetCompositionWindow");
							_t23 =  *0x504be4; // 0x74a30000
							 *0x50c154 = E00409620(_t33, _t40, _t23, L"ImmSetCompositionFontW");
							_t25 =  *0x504be4; // 0x74a30000
							 *0x50c158 = E00409620(_t33, _t40, _t25, L"ImmGetCompositionStringW");
							_t27 =  *0x504be4; // 0x74a30000
							 *0x50c15c = E00409620(_t33, _t40, _t27, L"ImmIsIME");
							_t29 =  *0x504be4; // 0x74a30000
							 *0x50c160 = E00409620(_t33, _t40, _t29, L"ImmNotifyIME");
						}
					}
					_pop(_t39);
					 *[fs:eax] = _t39;
					_push(0x46933d);
					_t9 = SetErrorMode(_v8); // executed
					return _t9;
				}
			}

0x004691d1
0x004691d4
0x004691d5
0x004691de
0x00469340
0x004691e4
0x004691e9
0x004691ee
0x004691f3
0x004691f4
0x004691f9
0x004691fc
0x00469206
0x00469212
0x0046921f
0x0046921f
0x0046922b
0x0046923b
0x00469247
0x00469252
0x0046925d
0x00469267
0x00469272
0x0046927c
0x00469287
0x00469291
0x0046929c
0x004692a6
0x004692b1
0x004692bb
0x004692c6
0x004692d0
0x004692db
0x004692e5
0x004692f0
0x004692fa
0x00469305
0x0046930f
0x0046931a
0x0046931a
0x00469247
0x00469321
0x00469324
0x00469327
0x00469330
0x00469335
0x00469335

APIs

SetErrorMode.KERNEL32(00008000), ref: 004691E9
GetModuleHandleW.KERNEL32(USER32,00000000,00469336,?,00008000), ref: 0046920D

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

LoadLibraryW.KERNEL32(imm32.dll,00000000,00469336,?,00008000), ref: 00469236
SetErrorMode.KERNEL32(?,0046933D,00008000), ref: 00469330

Strings

ImmSetOpenStatus, xrefs: 004692A1
ImmGetCompositionStringW, xrefs: 004692E0
ImmIsIME, xrefs: 004692F5
imm32.dll, xrefs: 00469231
ImmGetContext, xrefs: 0046924D
ImmGetConversionStatus, xrefs: 00469277
ImmReleaseContext, xrefs: 00469262
ImmSetConversionStatus, xrefs: 0046928C
WINNLSEnableIME, xrefs: 00469214
ImmSetCompositionFontW, xrefs: 004692CB
USER32, xrefs: 00469208
ImmSetCompositionWindow, xrefs: 004692B6
ImmNotifyIME, xrefs: 0046930A

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorMode$AddressHandleLibraryLoadModuleProc
String ID: ImmGetCompositionStringW$ImmGetContext$ImmGetConversionStatus$ImmIsIME$ImmNotifyIME$ImmReleaseContext$ImmSetCompositionFontW$ImmSetCompositionWindow$ImmSetConversionStatus$ImmSetOpenStatus$USER32$WINNLSEnableIME$imm32.dll
API String ID: 380357001-1271369619
Opcode ID: 9a336be1a68c2283c8be216bcbeb796796f1ddccb42f7d4bf3a0e2dcbda09585
Instruction ID: b68fd6cdddb62d6eb65d4c52eb707151846d17a924028d51ebc9fcbe0ed0ba4e
Opcode Fuzzy Hash: 9a336be1a68c2283c8be216bcbeb796796f1ddccb42f7d4bf3a0e2dcbda09585
Instruction Fuzzy Hash: 593162B1944340AEDB04DF66ED4AB5E37ACE359704B10482BB500973E3E6BD9C48EF59

Uniqueness

Uniqueness Score: -1.00%

Function 004696B8, Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 108
registrythreadwindowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004696B8(void* __ebx, void* __esi, void* __eflags) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				long _v28;
				char _v32;
				char _v36;
				intOrPtr _t25;
				char _t29;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr* _t50;
				intOrPtr _t56;
				intOrPtr* _t81;
				intOrPtr* _t83;
				intOrPtr _t87;
				void* _t91;

				_push(__ebx);
				_v20 = 0;
				_v8 = 0;
				_push(_t91);
				 *[fs:eax] = _t91 + 0xffffffe0;
				_v16 = GetCurrentProcessId();
				_v12 = 0;
				E0040E2C8(L"Delphi%.8X", 0,  &_v16,  &_v8);
				E00406448(0x50c0f0, _v8,  *[fs:eax]);
				_t25 =  *0x50c0f0; // 0x0
				 *0x50c0ec = GlobalAddAtomW(E004064D4(_t25));
				_t29 =  *0x509b50; // 0x400000
				_v36 = _t29;
				_v32 = 0;
				_v28 = GetCurrentThreadId();
				_v24 = 0;
				E0040E2C8(L"ControlOfs%.8X%.8X", 1,  &_v36,  &_v20);
				E00406448(0x50c0f4, _v20, 0x469843);
				_t35 =  *0x50c0f4; // 0x0
				 *0x50c0ee = GlobalAddAtomW(E004064D4(_t35));
				_t38 =  *0x50c0f4; // 0x0
				 *0x50c0f8 = RegisterWindowMessageW(E004064D4(_t38));
				 *0x50c130 = E00423884(1); // executed
				E004691D0(); // executed
				 *0x50c0d8 = E00468F68(1, 1);
				_t47 = E00479464(1);
				_t81 =  *0x506040; // 0x50c180
				 *_t81 = _t47;
				_t49 = E0047A8C0(0, 1);
				_t83 =  *0x505e5c; // 0x50c17c
				 *_t83 = _t49;
				_t50 =  *0x505e5c; // 0x50c17c
				E0047CEB8( *_t50, 1);
				 *0x50c134 = E00459EF4(1);
				_t65 = GetModuleHandleW(L"USER32");
				_t56 =  *0x454420; // 0x454424
				E00422F6C(_t56, 0x457c78, 0x457c88);
				if(_t55 != 0) {
					 *0x504ab4 = E00409620(_t65, __esi, _t65, L"AnimateWindow");
				}
				_pop(_t87);
				 *[fs:eax] = _t87;
				_push(0x46984a);
				L00406438( &_v20);
				return L00406438( &_v8);
			}

0x004696be
0x004696c1
0x004696c4
0x004696c9
0x004696d2
0x004696de
0x004696e1
0x004696ef
0x004696fc
0x00469701
0x00469711
0x0046971b
0x00469720
0x00469723
0x0046972c
0x0046972f
0x00469740
0x0046974d
0x00469752
0x00469762
0x00469768
0x00469778
0x00469789
0x0046978e
0x0046979f
0x004697ad
0x004697b2
0x004697b8
0x004697c3
0x004697c8
0x004697ce
0x004697d0
0x004697d9
0x004697ec
0x004697fb
0x00469807
0x0046980c
0x00469813
0x00469820
0x00469820
0x00469827
0x0046982a
0x0046982d
0x00469835
0x00469842

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00469843), ref: 004696D9
GlobalAddAtomW.KERNEL32(00000000,?,00000000,00469843), ref: 0046970C
GetCurrentThreadId.KERNEL32(?,00000000,?,00000000,00469843), ref: 00469727
GlobalAddAtomW.KERNEL32(00000000,?,00000000,?,00000000,00469843), ref: 0046975D
RegisterWindowMessageW.USER32(00000000,00000000,?,00000000,?,00000000,00469843), ref: 00469773

Part of subcall function 00423884: InitializeCriticalSection.KERNEL32(00420F04,?,?,00469789,00000000,00000000,?,00000000,?,00000000,00469843), ref: 004238A3

Part of subcall function 004691D0: SetErrorMode.KERNEL32(00008000), ref: 004691E9
Part of subcall function 004691D0: GetModuleHandleW.KERNEL32(USER32,00000000,00469336,?,00008000), ref: 0046920D
Part of subcall function 004691D0: LoadLibraryW.KERNEL32(imm32.dll,00000000,00469336,?,00008000), ref: 00469236
Part of subcall function 004691D0: SetErrorMode.KERNEL32(?,0046933D,00008000), ref: 00469330

Part of subcall function 00479464: GetKeyboardLayout.USER32(00000000,?,?,00000000,?,004697B2,00000000,00000000,?,00000000,?,00000000,00469843), ref: 004794A9
Part of subcall function 00479464: GetDC.USER32(00000000,00000000,?,?,00000000,?,004697B2,00000000,00000000,?,00000000,?,00000000,00469843), ref: 004794FE
Part of subcall function 00479464: GetDeviceCaps.GDI32(00000000,0000005A,00000000,00000000,?,?,00000000,?,004697B2,00000000,00000000,?,00000000,?,00000000,00469843), ref: 00479508
Part of subcall function 00479464: ReleaseDC.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,?,?,00000000,?,004697B2,00000000,00000000,?,00000000,?), ref: 00479513

Part of subcall function 0047A8C0: OleInitialize.OLE32(00000000,?,?,?,004697C8,00000000,00000000,?,00000000,?,00000000,00469843), ref: 0047A8F1
Part of subcall function 0047A8C0: LoadIconW.USER32(00400000,MAINICON,?,?,?,004697C8,00000000,00000000,?,00000000,?,00000000,00469843), ref: 0047A9DC
Part of subcall function 0047A8C0: GetModuleFileNameW.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,004697C8,00000000,00000000,?,00000000,?,00000000,00469843), ref: 0047AA20

GetModuleHandleW.KERNEL32(USER32,00000000,00000000,?,00000000,?,00000000,00469843), ref: 004697F6

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

Strings

$DE, xrefs: 00469807
USER32, xrefs: 004697F1
Delphi%.8X, xrefs: 004696EA
tpE, xrefs: 00469795
ControlOfs%.8X%.8X, xrefs: 0046973B
AnimateWindow, xrefs: 00469815

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Module$AtomCurrentErrorGlobalHandleInitializeLoadMode$AddressCapsCriticalDeviceFileIconKeyboardLayoutLibraryMessageNameProcProcessRegisterReleaseSectionThreadWindow
String ID: $DE$AnimateWindow$ControlOfs%.8X%.8X$Delphi%.8X$USER32$tpE
API String ID: 2902964639-283800713
Opcode ID: 8a6f2753a71809324935081d47222959d04d77c028fd3910f507eda4feec987f
Instruction ID: 7eced25247dcdd96c4d81a6a4fd553991684df9a940afbf613cdc6bf25c6cf6f
Opcode Fuzzy Hash: 8a6f2753a71809324935081d47222959d04d77c028fd3910f507eda4feec987f
Instruction Fuzzy Hash: EE417270A00204DFC704EFA9DC9269E77E8AB5A308B51453BF405E73A2E6789D08DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0047B544, Relevance: 19.9, APIs: 13, Instructions: 429
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0047B544(struct HWND__* __eax, void* __ecx, struct HWND__* __edx) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v40;
				void* _v44;
				struct HWND__* _v56;
				char _v60;
				struct HWND__* _v72;
				void* _v76;
				void* __ebx;
				struct HWND__* __esi;
				void* __ebp;
				signed int _t168;
				struct HWND__* _t169;
				struct HWND__* _t170;
				struct HWND__* _t183;
				struct HWND__* _t192;
				struct HWND__* _t195;
				struct HWND__* _t196;
				struct HWND__* _t198;
				struct HWND__* _t204;
				struct HWND__* _t206;
				struct HWND__* _t209;
				struct HWND__* _t212;
				struct HWND__* _t213;
				struct HWND__* _t223;
				struct HWND__* _t227;
				struct HWND__* _t232;
				struct HWND__* _t234;
				intOrPtr _t235;
				intOrPtr _t237;
				struct HWND__* _t240;
				void* _t243;
				struct HWND__* _t249;
				struct HWND__* _t253;
				struct HWND__* _t261;
				intOrPtr _t273;
				intOrPtr _t275;
				struct HWND__* _t278;
				intOrPtr _t279;
				int* _t287;
				struct HWND__* _t293;
				struct HWND__* _t299;
				struct HWND__* _t301;
				struct HWND__* _t304;
				intOrPtr* _t307;
				void* _t321;
				signed int _t323;
				struct HWND__* _t326;
				struct HWND__* _t330;
				struct HWND__* _t331;
				struct HWND__* _t332;
				void* _t333;
				intOrPtr _t355;
				struct HWND__* _t359;
				struct HWND__* _t367;
				intOrPtr _t379;
				void* _t383;
				struct HWND__* _t387;
				void* _t390;
				void* _t391;
				intOrPtr _t392;

				_t333 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_push(_t391);
				_push(0x47bc66);
				_push( *[fs:edx]);
				 *[fs:edx] = _t392;
				 *(_v12 + 0xc) = 0;
				_t321 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xac)) + 8)) - 1;
				if(_t321 < 0) {
					L5:
					E0047B3B8(_v8, _t333, _v12);
					_t323 =  *_v12;
					_t168 = _t323;
					__eflags = _t168 - 0x53;
					if(__eflags > 0) {
						__eflags = _t168 - 0xb017;
						if(__eflags > 0) {
							__eflags = _t168 - 0xb020;
							if(__eflags > 0) {
								_t169 = _t168 - 0xb031;
								__eflags = _t169;
								if(_t169 == 0) {
									_t170 = _v12;
									__eflags =  *((intOrPtr*)(_t170 + 4)) - 1;
									if( *((intOrPtr*)(_t170 + 4)) != 1) {
										 *(_v8 + 0xb4) =  *(_v12 + 8);
									} else {
										 *(_v12 + 0xc) =  *(_v8 + 0xb4);
									}
									L111:
									_pop(_t355);
									 *[fs:eax] = _t355;
									return 0;
								}
								__eflags = _t169 + 0xfffffff2 - 2;
								if(_t169 + 0xfffffff2 - 2 < 0) {
									 *(_v12 + 0xc) = E0047DE3C(_v8,  *(_v12 + 8), _t323) & 0x0000007f;
								} else {
									L110:
									E0047B4B4(_t391); // executed
								}
								goto L111;
							}
							if(__eflags == 0) {
								_t183 = _v12;
								__eflags =  *(_t183 + 4);
								if( *(_t183 + 4) != 0) {
									E0047C4DC(_v8, _t333,  *( *(_v12 + 8)),  *((intOrPtr*)( *(_v12 + 8) + 4)));
								} else {
									E0047C47C(_v8,  *( *(_v12 + 8)),  *((intOrPtr*)( *(_v12 + 8) + 4)));
								}
								goto L111;
							}
							_t192 = _t168 - 0xb01a;
							__eflags = _t192;
							if(_t192 == 0) {
								_t195 = E00470AC4( *(_v8 + 0x170));
								__eflags = _t195;
								if(_t195 == 0) {
									_t196 = GetFocus();
									_t359 = _v8;
									__eflags = _t196 -  *((intOrPtr*)(_t359 + 0x170));
									if(_t196 ==  *((intOrPtr*)(_t359 + 0x170))) {
										_t198 = E00470DF4(0);
										__eflags = _t198;
										if(_t198 != 0) {
											SetFocus(_t198);
										}
									}
								}
								goto L111;
							}
							__eflags = _t192 == 5;
							if(_t192 == 5) {
								L96:
								E0047CB98(_v8,  *(_v12 + 8),  *(_v12 + 4) & 0x0000ffff);
								goto L111;
							} else {
								goto L110;
							}
						}
						if(__eflags == 0) {
							_t204 =  *(_v8 + 0x40);
							__eflags = _t204;
							if(_t204 != 0) {
								_t324 = _t204;
								_t206 = E00463AA8(_t204);
								__eflags = _t206;
								if(_t206 != 0) {
									_t209 = IsWindowEnabled(E00463AA8(_t324));
									__eflags = _t209;
									if(_t209 != 0) {
										_t212 = IsWindowVisible(E00463AA8(_t324));
										__eflags = _t212;
										if(_t212 != 0) {
											 *0x504c9c = 0;
											_t213 = GetFocus();
											SetFocus(E00463AA8(_t324));
											E0045C4F0(_t324,  *(_v12 + 4), 0x112,  *(_v12 + 8));
											SetFocus(_t213);
											 *0x504c9c = 1;
											 *(_v12 + 0xc) = 1;
										}
									}
								}
							}
							goto L111;
						}
						__eflags = _t168 - 0xb000;
						if(__eflags > 0) {
							_t223 = _t168 - 0xb001;
							__eflags = _t223;
							if(_t223 == 0) {
								 *(_v8 + 0xd0) = GetLastActivePopup( *(_v8 + 0x170));
								_t227 = _v8;
								__eflags =  *((short*)(_t227 + 0x13a));
								if( *((short*)(_t227 + 0x13a)) != 0) {
									 *((intOrPtr*)(_v8 + 0x138))();
								}
								goto L111;
							}
							__eflags = _t223 == 0x15;
							if(_t223 == 0x15) {
								_t232 = E0047C1E0(_v8, _t333, _v12);
								__eflags = _t232;
								if(_t232 != 0) {
									 *(_v12 + 0xc) = 1;
								}
								goto L111;
							} else {
								goto L110;
							}
						}
						if(__eflags == 0) {
							_t234 = _v8;
							__eflags =  *((short*)(_t234 + 0x142));
							if( *((short*)(_t234 + 0x142)) != 0) {
								 *((intOrPtr*)(_v8 + 0x140))();
							}
							_t235 =  *0x50c17c; // 0x0
							_t326 =  *(_t235 + 0x40);
							__eflags = _t326;
							if(_t326 != 0) {
								_t237 =  *0x50c17c; // 0x0
								__eflags =  *((char*)(_t237 + 0xcf));
								if( *((char*)(_t237 + 0xcf)) != 0) {
									_t240 = IsWindowEnabled(E00463AA8(_t326));
									__eflags = _t240;
									if(_t240 == 0) {
										_t243 = E00463AA8( *(_v8 + 0x40));
										_t367 = _v8;
										__eflags = _t243 -  *((intOrPtr*)(_t367 + 0xd0));
										if(_t243 !=  *((intOrPtr*)(_t367 + 0xd0))) {
											SetFocus( *(_v8 + 0xd0));
										}
									}
								}
							}
							 *(_v8 + 0xd0) = 0;
							goto L111;
						}
						_t249 = _t168 - 0x112;
						__eflags = _t249;
						if(_t249 == 0) {
							_t253 = ( *(_v12 + 4) & 0x0000fff0) - 0xf020;
							__eflags = _t253;
							if(_t253 == 0) {
								E0047BCA0(_v8, _t333);
							} else {
								__eflags = _t253 == 0x100;
								if(_t253 == 0x100) {
									E0047BDA4(_v8, _t333);
								} else {
									E0047B4B4(_t391);
								}
							}
							goto L111;
						}
						_t261 = _t249 + 0xffffffe0 - 7;
						__eflags = _t261;
						if(_t261 < 0) {
							 *(_v12 + 0xc) = SendMessageW( *(_v12 + 8), _t323 + 0xbc00,  *(_v12 + 4),  *(_v12 + 8));
							goto L111;
						}
						__eflags = _t261 == 0x1e1;
						if(_t261 == 0x1e1) {
							E0046B0D4(E0046AF6C());
							_v28 = 0xb051;
							_v24 = 0;
							_v20 = 0;
							_v16 = 0;
							_t273 =  *0x50c180; // 0x0
							_t330 = E00479780(_t273) - 1;
							__eflags = _t330;
							if(_t330 < 0) {
								goto L111;
							}
							_t331 =  &(_t330->i);
							_t387 = 0;
							__eflags = 0;
							do {
								_t275 =  *0x50c180; // 0x0
								E0045F794(E0047976C(_t275, _t387), _t333,  &_v28, __eflags);
								_t387 =  &(_t387->i);
								_t331 = _t331 - 1;
								__eflags = _t331;
							} while (__eflags != 0);
							goto L111;
						} else {
							goto L110;
						}
					}
					if(__eflags == 0) {
						goto L96;
					}
					__eflags = _t168 - 0x11;
					if(__eflags > 0) {
						__eflags = _t168 - 0x1c;
						if(__eflags > 0) {
							_t278 = _t168 - 0x1d;
							__eflags = _t278;
							if(_t278 == 0) {
								_t279 =  *0x50c180; // 0x0
								E0047A4D8(_t279);
								E0047B4B4(_t391);
								goto L111;
							}
							__eflags = _t278 == 0x1a;
							if(_t278 == 0x1a) {
								 *(_v12 + 0xc) = E0047BC84(_v8);
								goto L111;
							} else {
								goto L110;
							}
						}
						if(__eflags == 0) {
							E0047B4B4(_t391);
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							__eflags = _v40 - 1;
							asm("sbb eax, eax");
							_t287 =  &(_v12->i);
							 *(_v8 + 0xa1) = _t287;
							__eflags = _t287;
							if(_t287 == 0) {
								E0047B05C();
								PostMessageW( *(_v8 + 0x170), 0xb001, 0, 0); // executed
							} else {
								_t293 = _v8;
								__eflags =  *((char*)(_t293 + 0xcf));
								if( *((char*)(_t293 + 0xcf)) != 0) {
									_t299 = _v8;
									__eflags =  *((char*)(_t299 + 0x30));
									if( *((char*)(_t299 + 0x30)) != 0) {
										 *((char*)(_v8 + 0x30)) = 0;
									}
								}
								E0047B0BC(_v8);
								PostMessageW( *(_v8 + 0x170), 0xb000, 0, 0); // executed
							}
							goto L111;
						}
						_t301 = _t168 - 0x14;
						__eflags = _t301;
						if(_t301 == 0) {
							 *_v12 = 0x27;
							E0047B4B4(_t391);
							goto L111;
						}
						_t304 = _t301 - 2;
						__eflags = _t304;
						if(_t304 == 0) {
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							__eflags = _v72;
							if(_v72 != 0) {
								E00405084();
							}
							goto L111;
						}
						__eflags = _t304 == 4;
						if(_t304 == 4) {
							_t307 =  *0x505ff4; // 0x50c0d8
							E0046916C( *_t307, _t333,  *(_v12 + 4));
							E0047B438(_v8, _t323, _v12, _t383);
							E0047B4B4(_t391);
							goto L111;
						} else {
							goto L110;
						}
					}
					if(__eflags == 0) {
						 *(_v12 + 0xc) = 1;
						goto L111;
					}
					__eflags = _t168 - 0x10;
					if(_t168 > 0x10) {
						goto L110;
					}
					switch( *((intOrPtr*)(_t168 * 4 +  &M0047B5E8))) {
						case 0:
							0 = E0042A3FC(0, __ebx, __edi, __esi);
							goto L111;
						case 1:
							goto L110;
						case 2:
							__eax = _v12;
							__eflags =  *((intOrPtr*)(__eax + 4)) - 1;
							if( *((intOrPtr*)(__eax + 4)) == 1) {
								__eax = _v8;
								 *((char*)(_v8 + 0x30)) = 1;
							}
							goto L111;
						case 3:
							_push(0);
							_push(0);
							_push(0xb01a);
							_v8 =  *(_v8 + 0x170);
							_push( *(_v8 + 0x170));
							L00409F54();
							__eax = E0047B4B4(__ebp);
							goto L111;
						case 4:
							__eax = _v12;
							__esi = _v12;
							__edi =  &_v60;
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							__eflags = _v56;
							if(_v56 == 0) {
								__eax = E0047B4B4(__ebp);
								__eax = _v8;
								__eflags =  *(__eax + 0xb0);
								if( *(__eax + 0xb0) == 0) {
									__eflags =  *0x504cb0;
									if( *0x504cb0 == 0) {
										__eax = _v8;
										__eax =  *(_v8 + 0x170);
										__eax = E00470C94( *(_v8 + 0x170), __ebx,  &_v60, __esi);
										__edx = _v8;
										 *(_v8 + 0xb0) = __eax;
									}
								}
								_v8 = L0047B064();
								goto L111;
							}
							__eflags =  *0x504cb0;
							if( *0x504cb0 == 0) {
								_v8 = E0047B0BC(_v8);
								__eax = _v8;
								__eax =  *(_v8 + 0xb0);
								__eflags = __eax;
								if(__eax != 0) {
									__eax = _v8;
									__edx = 0;
									__eflags = 0;
									 *(_v8 + 0xb0) = 0;
								}
							}
							__eax = E0047B4B4(__ebp);
							goto L111;
						case 5:
							__eax = _v8;
							__eax =  *(_v8 + 0x170);
							__eax = E00470AC4( *(_v8 + 0x170));
							__eflags = __eax;
							if(__eax == 0) {
								__eax = E0047B4B4(__ebp);
							} else {
								__eax = E0047B4F4(__ebp);
							}
							goto L111;
						case 6:
							__eax = _v8;
							__eax =  *(_v8 + 0x40);
							__eflags = __eax;
							if(__eax != 0) {
								__eax = E00477EA4(__eax, __ecx);
							}
							goto L111;
					}
				} else {
					_t332 = _t321 + 1;
					_t390 = 0;
					do {
						if( *((intOrPtr*)(E00423584( *((intOrPtr*)(_v8 + 0xac)), _t390)))() != 0) {
							_pop(_t379);
							 *[fs:eax] = _t379;
							return 0;
						}
						_t390 = _t390 + 1;
						_t332 = _t332 - 1;
						__eflags = _t332;
					} while (_t332 != 0);
					goto L5;
				}
			}

0x0047b544
0x0047b54d
0x0047b550
0x0047b555
0x0047b556
0x0047b55b
0x0047b55e
0x0047b566
0x0047b575
0x0047b578
0x0047b5ac
0x0047b5b2
0x0047b5ba
0x0047b5bc
0x0047b5be
0x0047b5c1
0x0047b66e
0x0047b673
0x0047b6c4
0x0047b6c9
0x0047b6ea
0x0047b6ea
0x0047b6ef
0x0047bb94
0x0047bb97
0x0047bb9b
0x0047bbba
0x0047bb9d
0x0047bba9
0x0047bba9
0x0047bc5c
0x0047bc5e
0x0047bc61
0x00000000
0x0047bc61
0x0047b6f8
0x0047b6fb
0x0047b97b
0x0047b701
0x0047bc55
0x0047bc56
0x0047bc5b
0x00000000
0x0047b6fb
0x0047b6cb
0x0047bb5b
0x0047bb5e
0x0047bb62
0x0047bb8a
0x0047bb64
0x0047bb72
0x0047bb72
0x00000000
0x0047bb62
0x0047b6d1
0x0047b6d1
0x0047b6d6
0x0047bb06
0x0047bb0b
0x0047bb0d
0x0047bb13
0x0047bb18
0x0047bb1b
0x0047bb21
0x0047bb29
0x0047bb2e
0x0047bb30
0x0047bb37
0x0047bb37
0x0047bb30
0x0047bb21
0x00000000
0x0047bb0d
0x0047b6dc
0x0047b6df
0x0047bb41
0x0047bb51
0x00000000
0x0047b6e5
0x00000000
0x0047b6e5
0x0047b6df
0x0047b675
0x0047b9a8
0x0047b9ab
0x0047b9ad
0x0047b9b3
0x0047b9b7
0x0047b9bc
0x0047b9be
0x0047b9cc
0x0047b9d1
0x0047b9d3
0x0047b9e1
0x0047b9e6
0x0047b9e8
0x0047b9ee
0x0047b9f5
0x0047ba04
0x0047ba1d
0x0047ba23
0x0047ba28
0x0047ba32
0x0047ba32
0x0047b9e8
0x0047b9d3
0x0047b9be
0x00000000
0x0047b9ad
0x0047b67b
0x0047b680
0x0047b6ab
0x0047b6ab
0x0047b6b0
0x0047bacf
0x0047bad5
0x0047bad8
0x0047bae0
0x0047baf2
0x0047baf2
0x00000000
0x0047bae0
0x0047b6b6
0x0047b6b9
0x0047b989
0x0047b98e
0x0047b990
0x0047b999
0x0047b999
0x00000000
0x0047b6bf
0x00000000
0x0047b6bf
0x0047b6b9
0x0047b682
0x0047ba3e
0x0047ba41
0x0047ba49
0x0047ba57
0x0047ba57
0x0047ba5d
0x0047ba62
0x0047ba65
0x0047ba67
0x0047ba69
0x0047ba6e
0x0047ba75
0x0047ba7f
0x0047ba84
0x0047ba86
0x0047ba8e
0x0047ba93
0x0047ba96
0x0047ba9c
0x0047baa8
0x0047baa8
0x0047ba9c
0x0047ba86
0x0047ba75
0x0047bab2
0x00000000
0x0047bab2
0x0047b688
0x0047b688
0x0047b68d
0x0047b711
0x0047b711
0x0047b716
0x0047b724
0x0047b718
0x0047b718
0x0047b71d
0x0047b731
0x0047b71f
0x0047b73c
0x0047b741
0x0047b71d
0x00000000
0x0047b716
0x0047b692
0x0047b692
0x0047b695
0x0047b92b
0x00000000
0x0047b92b
0x0047b69b
0x0047b6a0
0x0047bc03
0x0047bc08
0x0047bc11
0x0047bc16
0x0047bc1b
0x0047bc1e
0x0047bc2a
0x0047bc2b
0x0047bc2d
0x00000000
0x00000000
0x0047bc2f
0x0047bc30
0x0047bc30
0x0047bc32
0x0047bc34
0x0047bc41
0x0047bc46
0x0047bc47
0x0047bc47
0x0047bc47
0x00000000
0x0047b6a6
0x00000000
0x0047b6a6
0x0047b6a0
0x0047b5c7
0x00000000
0x00000000
0x0047b5cd
0x0047b5d0
0x0047b62c
0x0047b62f
0x0047b657
0x0047b657
0x0047b65a
0x0047bbeb
0x0047bbf0
0x0047bbf6
0x00000000
0x0047bbfb
0x0047b660
0x0047b663
0x0047b7c2
0x00000000
0x0047b669
0x00000000
0x0047b669
0x0047b663
0x0047b631
0x0047b7ef
0x0047b7fd
0x0047b7fe
0x0047b7ff
0x0047b800
0x0047b801
0x0047b805
0x0047b807
0x0047b80b
0x0047b811
0x0047b813
0x0047b859
0x0047b871
0x0047b815
0x0047b815
0x0047b818
0x0047b81f
0x0047b821
0x0047b824
0x0047b828
0x0047b82d
0x0047b82d
0x0047b828
0x0047b834
0x0047b84c
0x0047b84c
0x00000000
0x0047b813
0x0047b637
0x0047b637
0x0047b63a
0x0047b7a5
0x0047b7ac
0x00000000
0x0047b7b1
0x0047b640
0x0047b640
0x0047b643
0x0047b93b
0x0047b93c
0x0047b93d
0x0047b93e
0x0047b93f
0x0047b943
0x0047b949
0x0047b949
0x00000000
0x0047b943
0x0047b649
0x0047b64c
0x0047bbcb
0x0047bbd2
0x0047bbdd
0x0047bbe3
0x00000000
0x0047b652
0x00000000
0x0047b652
0x0047b64c
0x0047b5d2
0x0047b956
0x00000000
0x0047b956
0x0047b5d8
0x0047b5db
0x00000000
0x00000000
0x0047b5e1
0x00000000
0x0047bc4e
0x00000000
0x00000000
0x00000000
0x00000000
0x0047b747
0x0047b74a
0x0047b74e
0x0047b754
0x0047b757
0x0047b757
0x00000000
0x00000000
0x0047b7ca
0x0047b7cc
0x0047b7ce
0x0047b7d6
0x0047b7dc
0x0047b7dd
0x0047b7e3
0x00000000
0x00000000
0x0047b87b
0x0047b87e
0x0047b880
0x0047b883
0x0047b884
0x0047b885
0x0047b886
0x0047b887
0x0047b88b
0x0047b8c8
0x0047b8ce
0x0047b8d1
0x0047b8d8
0x0047b8da
0x0047b8e1
0x0047b8e3
0x0047b8e6
0x0047b8ec
0x0047b8f1
0x0047b8f4
0x0047b8f4
0x0047b8e1
0x0047b8fd
0x00000000
0x0047b8fd
0x0047b88d
0x0047b894
0x0047b899
0x0047b89e
0x0047b8a1
0x0047b8a7
0x0047b8a9
0x0047b8b0
0x0047b8b3
0x0047b8b3
0x0047b8b5
0x0047b8b5
0x0047b8a9
0x0047b8bc
0x00000000
0x00000000
0x0047b778
0x0047b77b
0x0047b781
0x0047b786
0x0047b788
0x0047b797
0x0047b78a
0x0047b78b
0x0047b790
0x00000000
0x00000000
0x0047b760
0x0047b763
0x0047b766
0x0047b768
0x0047b76e
0x0047b76e
0x00000000
0x00000000
0x0047b57a
0x0047b57a
0x0047b57b
0x0047b57d
0x0047b599
0x0047b59d
0x0047b5a0
0x00000000
0x0047b5a0
0x0047b5a8
0x0047b5a9
0x0047b5a9
0x0047b5a9
0x00000000
0x0047b57d

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b67166efc31e826feda30eef4c54a69903b8f1ef8454b9d449093f1ed808a14
Instruction ID: 2344604fbe9f4beace1891af33759c6bc086ca627aba7588f7706b1a81c40fe6
Opcode Fuzzy Hash: 6b67166efc31e826feda30eef4c54a69903b8f1ef8454b9d449093f1ed808a14
Instruction Fuzzy Hash: EFF13D31600204DFDB11DF69C585BDEB7B5EF48314F24C1AAE94CAB352CB38AE419B99

Uniqueness

Uniqueness Score: -1.00%

Function 004DF7F0, Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 193
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E004DF7F0(void* __ebx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v52;
				char _v56;
				intOrPtr* _t45;
				intOrPtr _t56;
				intOrPtr _t64;
				void* _t71;
				char _t73;
				intOrPtr _t78;
				intOrPtr _t83;
				intOrPtr _t96;
				intOrPtr _t102;
				void* _t112;
				void* _t113;
				intOrPtr _t139;
				intOrPtr _t144;
				intOrPtr _t146;
				intOrPtr _t153;
				intOrPtr _t161;
				intOrPtr _t162;

				_t112 = __ebx;
				_t161 = _t162;
				_t113 = 6;
				do {
					_push(0);
					_push(0);
					_t113 = _t113 - 1;
					_t163 = _t113;
				} while (_t113 != 0);
				_push(_t113);
				 *[fs:eax] = _t162;
				E0047F7AC( &_v12);
				E00406448(0x50cdcc, _v12,  *[fs:eax]);
				E0047F7D8( &_v16);
				E00406448(0x50cdd0, _v16, 0x4dface);
				E0047F804( &_v20, _t113, __esi, _t161, _t163);
				E00406448(0x50cdd4, _v20, _t161);
				_t45 =  *0x50605c; // 0x503914
				_t164 =  *_t45 - 2;
				if( *_t45 != 2) {
					__eflags = 0;
					E00406448(0x50cdd8, 0);
				} else {
					E0047F0D8(L"SystemDrive", _t113,  &_v24, _t164);
					E00406448(0x50cdd8, _v24);
				}
				if( *0x50cdd8 == 0) {
					_t102 =  *0x50cdcc; // 0x0
					E0047E82C(_t102, _t113,  &_v28);
					E00406448(0x50cdd8, _v28);
					_t166 =  *0x50cdd8;
					if( *0x50cdd8 == 0) {
						E00406448(0x50cdd8, 0x4dfb0c);
					}
				}
				E004DF680(1, L"ProgramFilesDir", _t166); // executed
				E00406448(0x50cddc, _v32);
				_t167 =  *0x50cddc;
				if( *0x50cddc == 0) {
					_t153 =  *0x50cdd8; // 0x0
					E00406914(0x50cddc, L"\\Program Files", _t153);
				}
				E004DF680(1, L"CommonFilesDir", _t167); // executed
				E00406448(0x50cde0, _v36);
				if( *0x50cde0 == 0) {
					_t96 =  *0x50cddc; // 0x0
					E0047E328(_t96,  &_v40);
					E00406914(0x50cde0, L"Common Files", _v40);
				}
				_t169 =  *0x50d05a;
				if( *0x50d05a != 0) {
					E004DF680(2, L"ProgramFilesDir", _t169); // executed
					E00406448(0x50cde4, _v44);
					_t170 =  *0x50cde4;
					if( *0x50cde4 == 0) {
						E004ADE4C(L"Failed to get path of 64-bit Program Files directory", _t112);
					}
					E004DF680(2, L"CommonFilesDir", _t170); // executed
					E00406448(0x50cde8, _v48);
					if( *0x50cde8 == 0) {
						E004ADE4C(L"Failed to get path of 64-bit Common Files directory", _t112);
					}
				}
				if( *0x50d124 == 0 ||  *0x50d06c >> 0x10 < 0x600) {
					L23:
					__eflags =  *0x50d059;
					if( *0x50d059 == 0) {
						_t56 =  *0x50cdcc; // 0x0
						E0047E328(_t56,  &_v56);
						E00406914(0x50cdf4, L"COMMAND.COM", _v56); // executed
					} else {
						_t64 =  *0x50cdd0; // 0x0
						E0047E328(_t64,  &_v52);
						E00406914(0x50cdf4, L"cmd.exe", _v52);
					}
					E004DF734(); // executed
					__eflags = 0;
					_pop(_t139);
					 *[fs:eax] = _t139;
					_push(E004DFAD5);
					return L00406440( &_v56, 0xc);
				} else {
					_t71 =  *0x50d124(0x5055a4, 0x8000, 0,  &_v8); // executed
					if(_t71 != 0) {
						_t73 =  *0x50d124(0x5055b4, 0x8000, 0,  &_v8); // executed
						__eflags = _t73;
						if(_t73 != 0) {
							goto L23;
						} else {
							_push(_t161);
							_push(0x4dfa5e);
							_push( *[fs:eax]);
							 *[fs:eax] = _t162;
							E00407690();
							__eflags = 0;
							_pop(_t144);
							 *[fs:eax] = _t144;
							_push(E004DFA65);
							_t78 = _v8;
							_push(_t78);
							L00415164();
							return _t78;
						}
					} else {
						_push(_t161);
						_push(0x4dfa0b);
						_push( *[fs:eax]);
						 *[fs:eax] = _t162;
						E00407690();
						_pop(_t146);
						 *[fs:eax] = _t146;
						_push(E004DFA12);
						_t83 = _v8;
						_push(_t83);
						L00415164();
						return _t83;
					}
				}
			}

0x004df7f0
0x004df7f1
0x004df7f3
0x004df7f8
0x004df7f8
0x004df7fa
0x004df7fc
0x004df7fc
0x004df7fc
0x004df7ff
0x004df80b
0x004df811
0x004df81e
0x004df826
0x004df833
0x004df83b
0x004df848
0x004df84d
0x004df852
0x004df855
0x004df878
0x004df87a
0x004df857
0x004df85f
0x004df86c
0x004df86c
0x004df886
0x004df88b
0x004df890
0x004df89d
0x004df8a2
0x004df8a9
0x004df8b5
0x004df8b5
0x004df8a9
0x004df8c4
0x004df8d1
0x004df8d6
0x004df8dd
0x004df8e9
0x004df8ef
0x004df8ef
0x004df8fe
0x004df90b
0x004df917
0x004df91c
0x004df921
0x004df933
0x004df933
0x004df938
0x004df93f
0x004df94b
0x004df958
0x004df95d
0x004df964
0x004df96b
0x004df96b
0x004df97a
0x004df987
0x004df993
0x004df99a
0x004df99a
0x004df993
0x004df9a6
0x004dfa65
0x004dfa65
0x004dfa6c
0x004dfa92
0x004dfa97
0x004dfaa9
0x004dfa6e
0x004dfa71
0x004dfa76
0x004dfa88
0x004dfa88
0x004dfaae
0x004dfab3
0x004dfab5
0x004dfab8
0x004dfabb
0x004dfacd
0x004df9bf
0x004df9cf
0x004df9d7
0x004dfa22
0x004dfa28
0x004dfa2a
0x00000000
0x004dfa2c
0x004dfa2e
0x004dfa2f
0x004dfa34
0x004dfa37
0x004dfa42
0x004dfa47
0x004dfa49
0x004dfa4c
0x004dfa4f
0x004dfa54
0x004dfa57
0x004dfa58
0x004dfa5d
0x004dfa5d
0x004df9d9
0x004df9db
0x004df9dc
0x004df9e1
0x004df9e4
0x004df9ef
0x004df9f6
0x004df9f9
0x004df9fc
0x004dfa01
0x004dfa04
0x004dfa05
0x004dfa0a
0x004dfa0a
0x004df9d7

APIs

CoTaskMemFree.OLE32(?,004DFA12,?,00000005,00000000,00000000,?,004FEA10,00000006,?,00000000,004FEFC1,?,00000000,004FF080), ref: 004DFA05
CoTaskMemFree.OLE32(?,004DFA65,?,00000005,00000000,00000000,?,004FEA10,00000006,?,00000000,004FEFC1,?,00000000,004FF080), ref: 004DFA58

Strings

ProgramFilesDir, xrefs: 004DF8BD, 004DF944
Failed to get path of 64-bit Common Files directory, xrefs: 004DF995
COMMAND.COM, xrefs: 004DFAA4
Failed to get path of 64-bit Program Files directory, xrefs: 004DF966
Common Files, xrefs: 004DF92E
SystemDrive, xrefs: 004DF85A
\Program Files, xrefs: 004DF8E4
cmd.exe, xrefs: 004DFA83
CommonFilesDir, xrefs: 004DF8F7, 004DF973

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 734271698-544719455
Opcode ID: ac8ac6205392d1eb66f512e75a8f8e8bb9b73c944c5952cb075cf4855a3b21f3
Instruction ID: a269eae327f7fc78e6a2feb085f075fd019b666b7d33ac6f983d3fa322b76dc3
Opcode Fuzzy Hash: ac8ac6205392d1eb66f512e75a8f8e8bb9b73c944c5952cb075cf4855a3b21f3
Instruction Fuzzy Hash: 0971C675A002449FDB20EB95D86279E7BA5EB89304F608537F802A73D1C738AD09DB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0047AC88, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 131
windowregistryCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E0047AC88(void* __eax, void* __ebx, void* __ecx) {
				struct _WNDCLASSW _v44;
				char _v48;
				char* _t21;
				WCHAR* _t25;
				struct HINSTANCE__* _t26;
				intOrPtr* _t28;
				signed int _t31;
				intOrPtr* _t32;
				signed int _t35;
				struct HINSTANCE__* _t36;
				struct HWND__* _t40;
				char* _t44;
				char* _t49;
				long _t52;
				long _t56;
				struct HINSTANCE__* _t59;
				intOrPtr _t61;
				void* _t66;
				struct HMENU__* _t67;
				intOrPtr _t74;
				WCHAR* _t75;
				void* _t80;
				short _t85;

				_v48 = 0;
				_t66 = __eax;
				_push(_t80);
				_push(0x47ae39);
				_push( *[fs:eax]);
				 *[fs:eax] = _t80 + 0xffffffd4;
				if( *((char*)(__eax + 0xa8)) != 0) {
					L13:
					_pop(_t74);
					 *[fs:eax] = _t74;
					_push(0x47ae40);
					return L00406438( &_v48);
				}
				_t21 =  *0x505ef0; // 0x507054
				if( *_t21 != 0) {
					goto L13;
				}
				 *(_t66 + 0x174) = E00470F70(E0047B544, __eax);
				 *0x504da8 = L00409BCC;
				_t25 =  *0x504dc8; // 0x47a8a4
				_t26 =  *0x509b50; // 0x400000
				if(GetClassInfoW(_t26, _t25,  &_v44) == 0) {
					_t59 =  *0x509b50; // 0x400000
					 *0x504db4 = _t59;
					_t85 = RegisterClassW(0x504da4);
					if(_t85 == 0) {
						_t61 =  *0x505ab4; // 0x42e45c
						E00408D5C(_t61,  &_v48);
						E004119A0(_v48, 1);
						E00404A74();
					}
				}
				_t28 =  *0x505bec; // 0x50beb0
				_t31 =  *((intOrPtr*)( *_t28))(0, 0x84ca0000) >> 1;
				if(_t85 < 0) {
					asm("adc eax, 0x0");
				}
				_t32 =  *0x505bec; // 0x50beb0
				_t35 =  *((intOrPtr*)( *_t32))(1, _t31) >> 1;
				if(_t85 < 0) {
					asm("adc eax, 0x0");
				}
				_push(_t35);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_t36 =  *0x509b50; // 0x400000
				_push(_t36);
				_push(0);
				_t7 = _t66 + 0x88; // 0x470aa4
				E004064D4( *_t7);
				_t75 =  *0x504dc8; // 0x47a8a4
				_t40 = E0040A124(0x80, _t75); // executed
				 *(_t66 + 0x170) = _t40;
				 *((char*)(_t66 + 0xa8)) = 1;
				_t10 = _t66 + 0x174; // 0x56022444
				_t11 = _t66 + 0x170; // 0x8840c01b
				SetWindowLongW( *_t11, 0xfffffffc,  *_t10);
				_t44 =  *0x505cc4; // 0x50c0e4
				if( *_t44 != 0) {
					_t52 = E0047BC84(_t66);
					_t12 = _t66 + 0x170; // 0x8840c01b
					SendMessageW( *_t12, 0x80, 1, _t52); // executed
					_t56 = E0047BC84(_t66);
					_t13 = _t66 + 0x170; // 0x8840c01b
					SetClassLongW( *_t13, 0xfffffff2, _t56); // executed
				}
				_t14 = _t66 + 0x170; // 0x8840c01b
				_t67 = GetSystemMenu( *_t14, 0);
				DeleteMenu(_t67, 0xf030, 0);
				DeleteMenu(_t67, 0xf000, 0);
				_t49 =  *0x505cc4; // 0x50c0e4
				if( *_t49 != 0) {
					DeleteMenu(_t67, 0xf010, 0);
				}
				goto L13;
			}

0x0047ac91
0x0047ac94
0x0047ac98
0x0047ac99
0x0047ac9e
0x0047aca1
0x0047acab
0x0047ae23
0x0047ae25
0x0047ae28
0x0047ae2b
0x0047ae38
0x0047ae38
0x0047acb1
0x0047acb9
0x00000000
0x00000000
0x0047acca
0x0047acd5
0x0047acde
0x0047ace4
0x0047acf1
0x0047acf3
0x0047acf8
0x0047ad07
0x0047ad0a
0x0047ad0f
0x0047ad14
0x0047ad23
0x0047ad28
0x0047ad28
0x0047ad0a
0x0047ad34
0x0047ad3d
0x0047ad3f
0x0047ad41
0x0047ad41
0x0047ad47
0x0047ad50
0x0047ad52
0x0047ad54
0x0047ad54
0x0047ad57
0x0047ad58
0x0047ad5a
0x0047ad5c
0x0047ad5e
0x0047ad60
0x0047ad65
0x0047ad66
0x0047ad68
0x0047ad6e
0x0047ad75
0x0047ad80
0x0047ad85
0x0047ad8b
0x0047ad92
0x0047ad9b
0x0047ada2
0x0047ada7
0x0047adaf
0x0047adb3
0x0047adc0
0x0047adc7
0x0047adce
0x0047add6
0x0047addd
0x0047addd
0x0047ade4
0x0047adf0
0x0047adfa
0x0047ae07
0x0047ae0c
0x0047ae14
0x0047ae1e
0x0047ae1e
0x00000000

APIs

GetClassInfoW.USER32(00400000,0047A8A4,?,0047B544,00470A18), ref: 0047ACEA
RegisterClassW.USER32(00504DA4,00400000,0047A8A4,?,0047B544,00470A18), ref: 0047AD02

Part of subcall function 00408D5C: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00408DA1

SetWindowLongW.USER32(8840C01B,000000FC,56022444,00000000,00400000,00000000,00000000,00000000,00000000,00000000), ref: 0047ADA2
SendMessageW.USER32(8840C01B,00000080,00000001,00000000,8840C01B,000000FC,56022444,00000000,00400000,00000000,00000000,00000000,00000000,00000000), ref: 0047ADC7
SetClassLongW.USER32(8840C01B,000000F2,00000000,8840C01B,00000080,00000001,00000000,8840C01B,000000FC,56022444,00000000,00400000,00000000,00000000,00000000,00000000), ref: 0047ADDD
GetSystemMenu.USER32(8840C01B,00000000,8840C01B,000000FC,56022444,00000000,00400000,00000000,00000000,00000000,00000000,00000000), ref: 0047ADEB
DeleteMenu.USER32(00000000,0000F030,00000000,8840C01B,00000000,8840C01B,000000FC,56022444,00000000,00400000,00000000,00000000,00000000,00000000,00000000), ref: 0047ADFA
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,8840C01B,00000000,8840C01B,000000FC,56022444,00000000,00400000,00000000,00000000,00000000), ref: 0047AE07
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,8840C01B,00000000,8840C01B,000000FC,56022444,00000000,00400000), ref: 0047AE1E

Strings

\B, xrefs: 0047AD0F
TpP, xrefs: 0047ACB1

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$ClassDelete$Long$InfoLoadMessageRegisterSendStringSystemWindow
String ID: TpP$\B
API String ID: 2334458219-2924151059
Opcode ID: 168a2a214d6bf4a8467337b9d4983d7a10c78249154e3004e1de9e133e9df7c1
Instruction ID: 931a6d5901732c85422d9449cbb1a1a8c239683be2ba7827681938e53eda8fb1
Opcode Fuzzy Hash: 168a2a214d6bf4a8467337b9d4983d7a10c78249154e3004e1de9e133e9df7c1
Instruction Fuzzy Hash: E84187717443006FE711EB75DC81F9A37A9AB44308F544576F908EF2E3DA78AC048B69

Uniqueness

Uniqueness Score: -1.00%

Function 00477740, Relevance: 18.5, APIs: 12, Instructions: 474
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00477740(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				intOrPtr _t163;
				intOrPtr _t167;
				intOrPtr _t169;
				intOrPtr _t170;
				intOrPtr _t171;
				intOrPtr _t175;
				intOrPtr _t180;
				intOrPtr _t182;
				intOrPtr _t183;
				void* _t185;
				struct HWND__* _t186;
				signed int _t196;
				long _t245;
				intOrPtr _t251;
				int _t256;
				intOrPtr _t257;
				intOrPtr _t270;
				intOrPtr _t274;
				signed int _t280;
				signed int _t288;
				signed int _t295;
				void* _t297;
				void* _t299;
				intOrPtr _t310;
				intOrPtr _t314;
				intOrPtr _t318;
				intOrPtr _t319;
				void* _t327;
				void* _t329;
				intOrPtr _t336;
				signed int _t346;
				signed int _t347;
				void* _t349;
				signed int _t353;
				intOrPtr _t357;
				struct HWND__* _t362;
				signed int _t365;
				signed int _t366;
				signed int _t369;
				signed int _t371;
				signed int _t372;
				signed int _t373;
				signed int _t376;
				signed int _t378;
				signed int _t379;
				void* _t381;
				intOrPtr _t395;
				signed int _t412;
				signed int _t413;
				intOrPtr _t414;
				signed int _t424;
				signed int _t425;
				signed int _t427;
				signed int _t429;
				signed int _t430;
				signed int _t431;
				signed int _t433;
				signed int _t434;
				signed int _t436;
				signed int _t437;
				void* _t439;
				void* _t440;
				intOrPtr _t441;

				_t439 = _t440;
				_t441 = _t440 + 0xffffffe8;
				_v28 = 0;
				_v8 = __eax;
				_push(_t439);
				_push(0x477da2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t441;
				if(( *(_v8 + 0x1c) & 0x00000010) == 0 && ( *(_v8 + 0x374) & 0x00000004) != 0) {
					_t357 =  *0x506054; // 0x42e484
					E00408D5C(_t357,  &_v28);
					E004119A0(_v28, 1);
					E00404A74();
				}
				_t163 =  *0x50c17c; // 0x0
				E0047D360(_t163);
				 *(_v8 + 0x374) =  *(_v8 + 0x374) | 0x00000004;
				_push(_t439);
				_push(0x477d85);
				_push( *[fs:edx]);
				 *[fs:edx] = _t441;
				if(( *(_v8 + 0x1c) & 0x00000010) != 0) {
					_t167 = _v8;
					__eflags =  *(_t167 + 0x1c) & 0x00000010;
					if(( *(_t167 + 0x1c) & 0x00000010) != 0) {
						_t170 = _v8;
						__eflags =  *(_t170 + 0x30);
						if( *(_t170 + 0x30) != 0) {
							_t171 = _v8;
							__eflags =  *((char*)(_t171 + 0x1e2));
							if( *((char*)(_t171 + 0x1e2)) != 0) {
								ShowWindow(E00463AA8(_v8), 1);
							}
						}
					}
					L88:
					_pop(_t395);
					 *[fs:eax] = _t395;
					_push(0x477d8c);
					_t169 = _v8;
					 *(_t169 + 0x374) =  *(_t169 + 0x374) & 0x000000fb;
					return _t169;
				}
				_t175 = _v8;
				_t445 =  *((char*)(_t175 + 0x1e2));
				if( *((char*)(_t175 + 0x1e2)) == 0) {
					_push(_t439);
					_push(0x477c57);
					_push( *[fs:eax]);
					 *[fs:eax] = _t441;
					E004042A8(_v8, __eflags);
					 *[fs:eax] = 0;
					_t180 =  *0x50c180; // 0x0
					__eflags =  *((intOrPtr*)(_t180 + 0x64)) - _v8;
					if( *((intOrPtr*)(_t180 + 0x64)) == _v8) {
						__eflags = 0;
						E00476494(_v8, 0);
					}
					_t182 = _v8;
					__eflags =  *((char*)(_t182 + 0x287)) - 1;
					if( *((char*)(_t182 + 0x287)) != 1) {
						_t183 = _v8;
						__eflags =  *(_t183 + 0x374) & 0x00000008;
						if(( *(_t183 + 0x374) & 0x00000008) == 0) {
							_t362 = 0;
							_t185 = E00463AA8(_v8);
							_t186 = GetActiveWindow();
							__eflags = _t185 - _t186;
							if(_t185 == _t186) {
								_t196 = E00470AC4(E00463AA8(_v8));
								__eflags = _t196;
								if(_t196 == 0) {
									_t362 = E00470DF4(E00463AA8(_v8));
								}
							}
							__eflags = _t362;
							if(_t362 == 0) {
								ShowWindow(E00463AA8(_v8), 0); // executed
							} else {
								SetWindowPos(E00463AA8(_v8), 0, 0, 0, 0, 0, 0x97);
								SetActiveWindow(_t362);
							}
						} else {
							SetWindowPos(E00463AA8(_v8), 0, 0, 0, 0, 0, 0x97);
						}
					} else {
						 *((intOrPtr*)( *_v8 + 0xb0))();
					}
					goto L88;
				}
				_push(_t439);
				_push(0x4777f8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t441;
				E004042A8(_v8, _t445);
				 *[fs:eax] = 0;
				if( *(_v8 + 0x288) == 4 ||  *(_v8 + 0x288) == 6 &&  *((char*)(_v8 + 0x287)) == 1) {
					if( *((char*)(_v8 + 0x287)) != 1) {
						E0047A794( &_v24);
						_t365 = _v16 - _v24 -  *(_v8 + 0x48);
						__eflags = _t365;
						_t366 = _t365 >> 1;
						if(_t365 < 0) {
							asm("adc ebx, 0x0");
						}
						_t424 = _v12 - _v20 -  *(_v8 + 0x4c);
						__eflags = _t424;
						_t425 = _t424 >> 1;
						if(_t424 < 0) {
							asm("adc esi, 0x0");
						}
					} else {
						_t270 =  *0x50c17c; // 0x0
						_t369 = E0045AA70( *((intOrPtr*)(_t270 + 0x40))) -  *(_v8 + 0x48);
						_t366 = _t369 >> 1;
						if(_t369 < 0) {
							asm("adc ebx, 0x0");
						}
						_t274 =  *0x50c17c; // 0x0
						_t427 = E0045AAB4( *((intOrPtr*)(_t274 + 0x40))) -  *(_v8 + 0x4c);
						_t425 = _t427 >> 1;
						if(_t427 < 0) {
							asm("adc esi, 0x0");
						}
					}
					if(_t366 < E00479718()) {
						_t366 = E00479718();
					}
					if(_t425 < E0047970C()) {
						_t425 = E0047970C();
					}
					 *((intOrPtr*)( *_v8 + 0x88))( *(_v8 + 0x4c),  *(_v8 + 0x48));
					if( *((char*)(_v8 + 0x57)) != 0) {
						E00474FE0(_v8);
					}
					goto L65;
				} else {
					_t280 =  *(_v8 + 0x288) & 0x000000ff;
					__eflags = _t280 + 0xfa - 2;
					if(_t280 + 0xfa - 2 >= 0) {
						__eflags = _t280 - 5;
						if(_t280 == 5) {
							__eflags =  *((char*)(_v8 + 0x287)) - 1;
							if(__eflags != 0) {
								_t371 = E00479730() >> 1;
								if(__eflags < 0) {
									asm("adc ebx, 0x0");
								}
								_t372 = _t371 + E00479718();
								__eflags = _t372;
								_t288 =  *(_v8 + 0x48) >> 1;
								if(_t372 < 0) {
									asm("adc eax, 0x0");
								}
								_t373 = _t372 - _t288;
								__eflags = _t373;
								_t429 = E00479724() >> 1;
								if(_t373 < 0) {
									asm("adc esi, 0x0");
								}
								_t430 = _t429 + E0047970C();
								__eflags = _t430;
								_t295 =  *(_v8 + 0x4c) >> 1;
								if(_t430 < 0) {
									asm("adc eax, 0x0");
								}
								_t431 = _t430 - _t295;
								__eflags = _t431;
							} else {
								_t310 =  *0x50c17c; // 0x0
								_t376 = E0045AA70( *((intOrPtr*)(_t310 + 0x40))) -  *(_v8 + 0x48);
								__eflags = _t376;
								_t373 = _t376 >> 1;
								if(_t376 < 0) {
									asm("adc ebx, 0x0");
								}
								_t314 =  *0x50c17c; // 0x0
								_t433 = E0045AAB4( *((intOrPtr*)(_t314 + 0x40))) -  *(_v8 + 0x4c);
								__eflags = _t433;
								_t431 = _t433 >> 1;
								if(_t433 < 0) {
									asm("adc esi, 0x0");
								}
							}
							_t297 = E00479718();
							__eflags = _t373 - _t297;
							if(_t373 < _t297) {
								_t373 = E00479718();
							}
							_t299 = E0047970C();
							__eflags = _t431 - _t299;
							if(_t431 < _t299) {
								_t431 = E0047970C();
							}
							 *((intOrPtr*)( *_v8 + 0x88))( *(_v8 + 0x4c),  *(_v8 + 0x48));
						}
						L65:
						 *(_v8 + 0x288) = 0;
						if( *((char*)(_v8 + 0x287)) != 1) {
							ShowWindow(E00463AA8(_v8),  *(0x504d1c + ( *(_v8 + 0x283) & 0x000000ff) * 4)); // executed
						} else {
							if( *(_v8 + 0x283) != 2) {
								ShowWindow(E00463AA8(_v8),  *(0x504d1c + ( *(_v8 + 0x283) & 0x000000ff) * 4));
								_t245 =  *(_v8 + 0x48) |  *(_v8 + 0x4c) << 0x00000010;
								__eflags = _t245;
								CallWindowProcW(0x409bc4, E00463AA8(_v8), 5, 0, _t245);
								E0045B408(_v8);
							} else {
								_t256 = E00463AA8(_v8);
								_t257 =  *0x50c17c; // 0x0
								SendMessageW( *( *((intOrPtr*)(_t257 + 0x40)) + 0x36c), 0x223, _t256, 0);
								ShowWindow(E00463AA8(_v8), 3);
							}
							_t251 =  *0x50c17c; // 0x0
							SendMessageW( *( *((intOrPtr*)(_t251 + 0x40)) + 0x36c), 0x234, 0, 0);
						}
						goto L88;
					}
					_t318 =  *0x50c17c; // 0x0
					_t434 =  *(_t318 + 0x40);
					_t319 = _v8;
					__eflags =  *((char*)(_t319 + 0x288)) - 7;
					if( *((char*)(_t319 + 0x288)) == 7) {
						_t414 =  *0x46f368; // 0x46f3c0
						_t353 = E00404238( *(_v8 + 4), _t414);
						__eflags = _t353;
						if(_t353 != 0) {
							_t434 =  *(_v8 + 4);
						}
					}
					__eflags = _t434;
					if(_t434 == 0) {
						L35:
						_t378 = E00479700() -  *(_v8 + 0x48);
						__eflags = _t378;
						_t379 = _t378 >> 1;
						if(_t378 < 0) {
							asm("adc ebx, 0x0");
						}
						_t436 = E004796F4() -  *(_v8 + 0x4c);
						__eflags = _t436;
						_t437 = _t436 >> 1;
						if(_t436 < 0) {
							asm("adc esi, 0x0");
						}
						goto L39;
					} else {
						__eflags = _t434 - _v8;
						if(_t434 == _v8) {
							goto L35;
						}
						_t381 = E00473174(_t434);
						_t346 =  *((intOrPtr*)(_t434 + 0x48)) -  *(_v8 + 0x48);
						__eflags = _t346;
						_t347 = _t346 >> 1;
						if(_t346 < 0) {
							asm("adc eax, 0x0");
						}
						_t379 = _t381 + _t347;
						_t349 = E00473194(_t434);
						_t412 =  *((intOrPtr*)(_t434 + 0x4c)) -  *(_v8 + 0x4c);
						__eflags = _t412;
						_t413 = _t412 >> 1;
						if(_t412 < 0) {
							asm("adc edx, 0x0");
						}
						_t437 = _t349 + _t413;
						L39:
						_t327 = E00479718();
						__eflags = _t379 - _t327;
						if(_t379 < _t327) {
							_t379 = E00479718();
						}
						_t329 = E0047970C();
						__eflags = _t437 - _t329;
						if(_t437 < _t329) {
							_t437 = E0047970C();
						}
						 *((intOrPtr*)( *_v8 + 0x88))( *(_v8 + 0x4c),  *(_v8 + 0x48));
						_t336 = _v8;
						__eflags =  *((char*)(_t336 + 0x57));
						if( *((char*)(_t336 + 0x57)) != 0) {
							E00474FE0(_v8);
						}
						goto L65;
					}
				}
			}

0x00477741
0x00477743
0x0047774b
0x0047774e
0x00477753
0x00477754
0x00477759
0x0047775c
0x00477766
0x00477777
0x0047777c
0x0047778b
0x00477790
0x00477790
0x00477795
0x0047779a
0x004777a2
0x004777ab
0x004777ac
0x004777b1
0x004777b4
0x004777be
0x00477d3f
0x00477d42
0x00477d46
0x00477d48
0x00477d4b
0x00477d4f
0x00477d51
0x00477d54
0x00477d5b
0x00477d68
0x00477d68
0x00477d5b
0x00477d4f
0x00477d6d
0x00477d6f
0x00477d72
0x00477d75
0x00477d7a
0x00477d7d
0x00477d84
0x00477d84
0x004777c4
0x004777c7
0x004777ce
0x00477c35
0x00477c36
0x00477c3b
0x00477c3e
0x00477c48
0x00477c52
0x00477c6e
0x00477c76
0x00477c79
0x00477c7b
0x00477c80
0x00477c80
0x00477c85
0x00477c88
0x00477c8f
0x00477ca1
0x00477ca4
0x00477cab
0x00477ccf
0x00477cd4
0x00477cdb
0x00477ce0
0x00477ce2
0x00477cec
0x00477cf1
0x00477cf3
0x00477d02
0x00477d02
0x00477cf3
0x00477d04
0x00477d06
0x00477d38
0x00477d08
0x00477d20
0x00477d26
0x00477d26
0x00477cad
0x00477cc5
0x00477cc5
0x00477c91
0x00477c96
0x00477c96
0x00000000
0x00477c8f
0x004777d6
0x004777d7
0x004777dc
0x004777df
0x004777e9
0x004777f3
0x00477819
0x00477845
0x00477889
0x00477897
0x00477897
0x0047789a
0x0047789c
0x0047789e
0x0047789e
0x004778aa
0x004778aa
0x004778ad
0x004778af
0x004778b1
0x004778b1
0x00477847
0x00477847
0x00477859
0x0047785c
0x0047785e
0x00477860
0x00477860
0x00477863
0x00477875
0x00477878
0x0047787a
0x0047787c
0x0047787c
0x0047787a
0x004778c0
0x004778cc
0x004778cc
0x004778da
0x004778e6
0x004778e6
0x004778ff
0x0047790c
0x00477915
0x00477915
0x00000000
0x0047791f
0x00477922
0x0047792e
0x00477931
0x00477a44
0x00477a46
0x00477a4f
0x00477a56
0x00477a9e
0x00477aa0
0x00477aa2
0x00477aa2
0x00477aaf
0x00477aaf
0x00477ab7
0x00477ab9
0x00477abb
0x00477abb
0x00477abe
0x00477abe
0x00477acc
0x00477ace
0x00477ad0
0x00477ad0
0x00477add
0x00477add
0x00477ae5
0x00477ae7
0x00477ae9
0x00477ae9
0x00477aec
0x00477aec
0x00477a58
0x00477a58
0x00477a6a
0x00477a6a
0x00477a6d
0x00477a6f
0x00477a71
0x00477a71
0x00477a74
0x00477a86
0x00477a86
0x00477a89
0x00477a8b
0x00477a8d
0x00477a8d
0x00477a8b
0x00477af3
0x00477af8
0x00477afa
0x00477b06
0x00477b06
0x00477b0d
0x00477b12
0x00477b14
0x00477b20
0x00477b20
0x00477b39
0x00477b39
0x00477b3f
0x00477b42
0x00477b53
0x00477c29
0x00477b59
0x00477b63
0x00477bb6
0x00477bca
0x00477bca
0x00477bdf
0x00477be7
0x00477b65
0x00477b6a
0x00477b75
0x00477b84
0x00477b94
0x00477b94
0x00477bf5
0x00477c04
0x00477c04
0x00000000
0x00477b53
0x00477937
0x0047793c
0x0047793f
0x00477942
0x00477949
0x00477951
0x00477957
0x0047795c
0x0047795e
0x00477963
0x00477963
0x0047795e
0x00477966
0x00477968
0x004779a7
0x004779b6
0x004779b6
0x004779b9
0x004779bb
0x004779bd
0x004779bd
0x004779cf
0x004779cf
0x004779d2
0x004779d4
0x004779d6
0x004779d6
0x00000000
0x0047796a
0x0047796a
0x0047796d
0x00000000
0x00000000
0x00477976
0x0047797e
0x0047797e
0x00477981
0x00477983
0x00477985
0x00477985
0x00477988
0x0047798c
0x00477997
0x00477997
0x0047799a
0x0047799c
0x0047799e
0x0047799e
0x004779a3
0x004779d9
0x004779de
0x004779e3
0x004779e5
0x004779f1
0x004779f1
0x004779f8
0x004779fd
0x004779ff
0x00477a0b
0x00477a0b
0x00477a24
0x00477a2a
0x00477a2d
0x00477a31
0x00477a3a
0x00477a3a
0x00000000
0x00477a31
0x00477968

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 3ad19e96bd00f33ba8e4fcffb60c5726cbb119c64250399ee9ceac80ce2323a9
Instruction ID: f45c08f43e94e85b4036ed09ec09b5d3cbc53df3605d16c10132ab63a2be4838
Opcode Fuzzy Hash: 3ad19e96bd00f33ba8e4fcffb60c5726cbb119c64250399ee9ceac80ce2323a9
Instruction Fuzzy Hash: 6E128071A18244EFDB10EBACC985FDD77F4AB05304F5581A6E908EB362D738AE04DB49

Uniqueness

Uniqueness Score: -1.00%

Function 004616D4, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 192
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E004616D4(intOrPtr* __eax, void* __edx, void* __edi) {
				intOrPtr* _v8;
				struct HDC__* _v12;
				struct HBITMAP__* _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v68;
				intOrPtr _v72;
				int _v76;
				struct tagPAINTSTRUCT _v88;
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t62;
				struct HDC__* _t100;
				void* _t123;
				void* _t125;
				signed int _t151;
				signed int _t154;
				intOrPtr _t158;
				signed int _t159;
				void* _t163;
				struct HDC__* _t165;
				void* _t168;
				void* _t170;
				intOrPtr _t171;

				_t162 = __edi;
				_t168 = _t170;
				_t171 = _t170 + 0xffffffac;
				_push(_t163);
				_t123 = __edx;
				_v8 = __eax;
				if( *((char*)(_v8 + 0x254)) == 0 ||  *((intOrPtr*)(__edx + 4)) != 0) {
					if(( *(_v8 + 0x55) & 0x00000001) != 0 || E0045F774(_v8) != 0) {
						_t62 = E00460F54(_v8, _t123, _t123, _t162, _t163); // executed
					} else {
						_t62 =  *((intOrPtr*)( *_v8 - 0x10))();
					}
					return _t62;
				} else {
					if(E004396F8(_t125) == 0) {
						_t165 = BeginPaint(E00463AA8(_v8),  &_v88);
						_v16 = CreateCompatibleBitmap(_t165, _v72 - _v88.rcPaint, _v68 - _v76);
						_push(_t168);
						_push(0x461924);
						_push( *[fs:ecx]);
						 *[fs:ecx] = _t171;
						_v12 = CreateCompatibleDC(_t165);
						_v20 = SelectObject(_v12, _v16);
						_push(_t168);
						_push(0x4618eb);
						_push( *[fs:ecx]);
						 *[fs:ecx] = _t171;
						SetWindowOrgEx(_v12, _v88.rcPaint, _v76, 0);
						E0045C4F0(_v8, _v12, 0x14, _v12);
						 *((intOrPtr*)(_t123 + 4)) = _v12;
						E004616D4(_v8, _t123, __edi);
						 *((intOrPtr*)(_t123 + 4)) = 0;
						_t150 = _v76;
						BitBlt(_t165, _v88.rcPaint, _v76, _v72 - _v88.rcPaint, _v68 - _v76, _v12, _v88.rcPaint, _t150, 0xcc0020);
						_pop(_t151);
						 *[fs:eax] = _t151;
						_push(0x4618f2);
						_t56 =  &_v20; // 0x445966
						return SelectObject(_v12,  *_t56);
					} else {
						_t100 = BeginPaint(E00463AA8(_v8),  &_v88);
						_push(_t168);
						_push(0x461808);
						_push( *[fs:edx]);
						 *[fs:edx] = _t171;
						_v24 = E004386C8(_t100,  &(_v88.rcPaint),  &_v12, 0);
						if(_v24 == 0) {
							_pop(_t154);
							 *[fs:eax] = _t154;
							_push(0x46192b);
							return EndPaint(E00463AA8(_v8),  &_v88);
						} else {
							_push(_t168);
							_push(0x4617e1);
							_push( *[fs:edx]);
							 *[fs:edx] = _t171;
							E0045C4F0(_v8, _v12, 0x14, _v12);
							E0045C4F0(_v8, _v12, 0x318, 4);
							_t158 =  *0x46f368; // 0x46f3c0
							if(E00404238(_v8, _t158) == 0) {
								E004387E4(_v24, 0xff,  &(_v88.rcPaint));
							}
							_pop(_t159);
							 *[fs:eax] = _t159;
							_push(0x4617e8);
							return E00438768(_v24, _t159 | 0xffffffff);
						}
					}
				}
			}

0x004616d4
0x004616d5
0x004616d7
0x004616db
0x004616dc
0x004616de
0x004616eb
0x004616fa
0x0046171c
0x00461708
0x0046170f
0x0046170f
0x00461930
0x00461726
0x0046172d
0x00461821
0x00461837
0x0046183c
0x0046183d
0x00461842
0x00461845
0x0046184e
0x0046185e
0x00461863
0x00461864
0x00461869
0x0046186c
0x0046187d
0x00461891
0x00461899
0x004618a1
0x004618a8
0x004618b0
0x004618cb
0x004618d2
0x004618d5
0x004618d8
0x004618dd
0x004618ea
0x00461733
0x00461740
0x00461749
0x0046174a
0x0046174f
0x00461752
0x0046176a
0x00461771
0x004617ea
0x004617ed
0x004617f0
0x00461807
0x00461773
0x00461775
0x00461776
0x0046177b
0x0046177e
0x00461790
0x004617a2
0x004617aa
0x004617b7
0x004617c3
0x004617c3
0x004617ca
0x004617cd
0x004617d0
0x004617e0
0x004617e0
0x00461771
0x0046172d

APIs

BeginPaint.USER32(00000000,?), ref: 00461740

Part of subcall function 00460F54: BeginPaint.USER32(00000000,?), ref: 00460F7F
Part of subcall function 00460F54: EndPaint.USER32(00000000,?,004610BA), ref: 004610AD

Strings

fYD, xrefs: 004618DD, 004618E0

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Paint$Begin
String ID: fYD
API String ID: 3787552996-2849180948
Opcode ID: c0726ec21542adb12294963245dc4fe5e6e1bf2b4aaf104db6b6679e7502c6f7
Instruction ID: b8afb81f837ee3bc069154df2855e530260f118eb3373ce060ca268a9421db2a
Opcode Fuzzy Hash: c0726ec21542adb12294963245dc4fe5e6e1bf2b4aaf104db6b6679e7502c6f7
Instruction Fuzzy Hash: E6613171A00148AFDB04EFE9C992EAEBBF9EF49305F14406AF504E7251D738AE01CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004577C4, Relevance: 16.6, APIs: 11, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004577C4(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* _t29;
				void* _t32;
				void* _t38;
				void* _t42;
				void* _t46;
				void* _t54;
				intOrPtr* _t65;

				_t65 =  &_v8;
				_t29 =  *0x504abc; // 0x0
				 *((intOrPtr*)(_t29 + 0x24c)) = _a4;
				if(IsWindowUnicode(_a4) == 0) {
					_t32 =  *0x504abc; // 0x0
					SetWindowLongW(_a4, 0xfffffffc,  *(_t32 + 0x250));
					if((GetWindowLongW(_a4, 0xfffffff0) & 0x40000000) != 0 && GetWindowLongW(_a4, 0xfffffff4) == 0) {
						SetWindowLongW(_a4, 0xfffffff4, _a4);
					}
				} else {
					_t54 =  *0x504abc; // 0x0
					SetWindowLongW(_a4, 0xfffffffc,  *(_t54 + 0x250));
					if((GetWindowLongW(_a4, 0xfffffff0) & 0x40000000) != 0 && GetWindowLongW(_a4, 0xfffffff4) == 0) {
						SetWindowLongW(_a4, 0xfffffff4, _a4);
					}
				}
				_t38 =  *0x504abc; // 0x0
				SetPropW(_a4,  *0x50c0ee & 0x0000ffff, _t38);
				_t42 =  *0x504abc; // 0x0
				SetPropW(_a4,  *0x50c0ec & 0x0000ffff, _t42);
				_t46 =  *0x504abc; // 0x0
				 *0x504abc = 0; // executed
				_v8 =  *((intOrPtr*)(_t46 + 0x250))(_a4, _a8, _a12, _a16);
				return  *_t65;
			}

0x004577c9
0x004577cc
0x004577d4
0x004577e5
0x00457830
0x00457842
0x00457857
0x00457872
0x00457872
0x004577e7
0x004577e7
0x004577f9
0x0045780e
0x00457829
0x00457829
0x0045780e
0x00457877
0x00457889
0x0045788e
0x004578a0
0x004578b1
0x004578b6
0x004578c6
0x004578ce

APIs

IsWindowUnicode.USER32(?), ref: 004577DE
SetWindowLongW.USER32(?,000000FC,?,?), ref: 004577F9
GetWindowLongW.USER32(?,000000F0,?,000000FC,?,?), ref: 00457804
GetWindowLongW.USER32(?,000000F4,?,000000F0,?,000000FC,?,?), ref: 00457816
SetWindowLongW.USER32(?,000000F4,?,?,000000F4,?,000000F0,?,000000FC,?,?), ref: 00457829
SetWindowLongW.USER32(?,000000FC,?,?), ref: 00457842
GetWindowLongW.USER32(?,000000F0,?,000000FC,?,?), ref: 0045784D
GetWindowLongW.USER32(?,000000F4,?,000000F0,?,000000FC,?,?), ref: 0045785F
SetWindowLongW.USER32(?,000000F4,?,?,000000F4,?,000000F0,?,000000FC,?,?), ref: 00457872
SetPropW.USER32(?,00000000,00000000,?,000000F0,?,000000FC,?,?), ref: 00457889
SetPropW.USER32(?,00000000,00000000,?,00000000,00000000,?,000000F0,?,000000FC,?,?), ref: 004578A0

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$Prop$Unicode
String ID:
API String ID: 1693715928-0
Opcode ID: bea46abf72d939b43bf7a47dcefb11ba06367381fce4ee2e0f8b94fe7f992143
Instruction ID: e0de2746dcc8773331db223f71d18d1cdb2f8c69e4f6ac36fc47f2f12eab46c1
Opcode Fuzzy Hash: bea46abf72d939b43bf7a47dcefb11ba06367381fce4ee2e0f8b94fe7f992143
Instruction Fuzzy Hash: 5631E276604144BFDF50DF99DC84EAA37ACAB08364F104225BE14DB2E2D239DD54DB94

Uniqueness

Uniqueness Score: -1.00%

Function 004AA7D0, Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 74
libraryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E004AA7D0(void* __ebx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				struct HINSTANCE__* _t26;
				struct HINSTANCE__* _t28;
				struct HINSTANCE__* _t30;
				struct HINSTANCE__* _t32;
				struct HINSTANCE__* _t34;
				intOrPtr _t41;
				intOrPtr _t48;

				_t45 = __esi;
				_push(0);
				_push(0);
				_push(__ebx);
				_push(_t48);
				_push(0x4aa8ec);
				_push( *[fs:eax]);
				 *[fs:eax] = _t48;
				 *0x50c434 =  *0x50c434 + 1;
				if( *0x50c430 == 0 && (GetVersion() & 0x000000ff) >= 6) {
					E004AA7A0( &_v12);
					E0047E328(_v12,  &_v8);
					E00406854( &_v8, L"Rstrtmgr.dll");
					_t23 = LoadLibraryW(E004064D4(_v8)); // executed
					 *0x50c430 = _t23;
					if( *0x50c430 != 0) {
						_t24 =  *0x50c430; // 0x0
						 *0x50c414 = E00409620(__ebx, __esi, _t24, L"RmStartSession");
						_t26 =  *0x50c430; // 0x0
						 *0x50c418 = E00409620(__ebx, __esi, _t26, L"RmRegisterResources");
						_t28 =  *0x50c430; // 0x0
						 *0x50c41c = E00409620(__ebx, __esi, _t28, L"RmGetList");
						_t30 =  *0x50c430; // 0x0
						 *0x50c420 = E00409620(__ebx, _t45, _t30, L"RmShutdown");
						_t32 =  *0x50c430; // 0x0
						 *0x50c424 = E00409620(__ebx, _t45, _t32, L"RmRestart");
						_t34 =  *0x50c430; // 0x0
						 *0x50c428 = E00409620(__ebx, _t45, _t34, L"RmEndSession");
					}
				}
				_pop(_t41);
				 *[fs:eax] = _t41;
				_push(0x4aa8f3);
				return L00406440( &_v12, 2);
			}

0x004aa7d0
0x004aa7d3
0x004aa7d5
0x004aa7d7
0x004aa7da
0x004aa7db
0x004aa7e0
0x004aa7e3
0x004aa7e6
0x004aa7f3
0x004aa810
0x004aa81b
0x004aa828
0x004aa836
0x004aa83b
0x004aa847
0x004aa84e
0x004aa859
0x004aa863
0x004aa86e
0x004aa878
0x004aa883
0x004aa88d
0x004aa898
0x004aa8a2
0x004aa8ad
0x004aa8b7
0x004aa8c2
0x004aa8c2
0x004aa847
0x004aa8d3
0x004aa8d6
0x004aa8d9
0x004aa8eb

APIs

GetVersion.KERNEL32(00000000,004AA8EC,?,?,00000000,00000000,?,004E44CC), ref: 004AA7F9

Part of subcall function 004AA7A0: GetSystemDirectoryW.KERNEL32(?,00000104,?,?,004AA815,00000000,004AA8EC,?,?,00000000,00000000,?,004E44CC), ref: 004AA7B8

LoadLibraryW.KERNEL32(00000000,00000000,004AA8EC,?,?,00000000,00000000,?,004E44CC), ref: 004AA836

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,00000000,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409666

Strings

RmShutdown, xrefs: 004AA888
RmRestart, xrefs: 004AA89D
RmRegisterResources, xrefs: 004AA85E
RmStartSession, xrefs: 004AA849
Rstrtmgr.dll, xrefs: 004AA823
RmGetList, xrefs: 004AA873
RmEndSession, xrefs: 004AA8B2

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystemVersion
String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
API String ID: 2754715182-3419246398
Opcode ID: 652f1a7740dd934ee21c052d9c8ca4df502ee3278f3ef972ea84fedf93982b4e
Instruction ID: 08f254440084fcc0288c65f6f0ce8cc22b18627238b64ddf3984f8844692cada
Opcode Fuzzy Hash: 652f1a7740dd934ee21c052d9c8ca4df502ee3278f3ef972ea84fedf93982b4e
Instruction Fuzzy Hash: DE2171B0910200AFDB10FF61EC52B3E3BA8F766309F914A3BB400971A2D73C5919DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004610F0, Relevance: 15.2, APIs: 10, Instructions: 231
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E004610F0(intOrPtr __eax, void* __ecx, struct HDC__* __edx) {
				intOrPtr _v8;
				struct HDC__* _v12;
				int _v16;
				intOrPtr _v20;
				int _v24;
				intOrPtr _v28;
				struct tagRECT _v44;
				intOrPtr _t135;
				int _t138;
				void* _t220;
				int _t222;
				intOrPtr _t248;
				void* _t254;
				void* _t255;
				void* _t258;
				void* _t259;
				void* _t262;
				void* _t264;
				intOrPtr _t265;

				_t262 = _t264;
				_t265 = _t264 + 0xffffffd8;
				_t220 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				if( *((char*)(_v8 + 0x1e4)) != 0 &&  *((char*)(_v8 + 0x1e3)) != 0 &&  *((intOrPtr*)(_v8 + 0x1c0)) != 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x1c0)))) + 0x20))();
				}
				_t135 = _v8;
				_t136 =  *((intOrPtr*)(_t135 + 0x1d4));
				if( *((intOrPtr*)(_t135 + 0x1d4)) == 0) {
					L20:
					_t138 =  *(_v8 + 0x1d8);
					if(_t138 != 0) {
						_t254 =  *((intOrPtr*)(_t138 + 8)) - 1;
						if(_t254 >= 0) {
							_t255 = _t254 + 1;
							_v16 = 0;
							do {
								_t138 = E00423584( *(_v8 + 0x1d8), _v16);
								_t222 = _t138;
								if( *((char*)(_t222 + 0x1e1)) != 0 && ( *(_t222 + 0x50) & 0x00000010) != 0) {
									if(( *(_t222 + 0x1c) & 0x00000010) != 0 ||  *((char*)(_t222 + 0x57)) == 0) {
										if(( *(_t222 + 0x1c) & 0x00000010) != 0 && ( *(_t222 + 0x51) & 0x00000004) == 0 && ( *(_t222 + 0x55) & 0x00000008) == 0) {
											goto L30;
										}
									} else {
										L30:
										_t258 = CreateSolidBrush(E00430758(0xff000010));
										E00409158( *((intOrPtr*)(_t222 + 0x40)) - 1,  *((intOrPtr*)(_t222 + 0x40)) +  *((intOrPtr*)(_t222 + 0x48)),  *((intOrPtr*)(_t222 + 0x44)) - 1,  &_v44,  *((intOrPtr*)(_t222 + 0x44)) +  *((intOrPtr*)(_t222 + 0x4c)));
										FrameRect(_v12,  &_v44, _t258);
										DeleteObject(_t258);
										_t259 = CreateSolidBrush(E00430758(0xff000014));
										E00409158( *((intOrPtr*)(_t222 + 0x40)),  *((intOrPtr*)(_t222 + 0x40)) +  *((intOrPtr*)(_t222 + 0x48)) + 1,  *((intOrPtr*)(_t222 + 0x44)),  &_v44,  *((intOrPtr*)(_t222 + 0x44)) +  *((intOrPtr*)(_t222 + 0x4c)) + 1);
										FrameRect(_v12,  &_v44, _t259);
										_t138 = DeleteObject(_t259);
									}
								}
								_v16 = _v16 + 1;
								_t255 = _t255 - 1;
							} while (_t255 != 0);
						}
					}
					return _t138;
				} else {
					_v16 = 0;
					if(_t220 != 0) {
						_v16 = E004235E0(_t136, _t220);
						if(_v16 < 0) {
							_v16 = 0;
						}
					}
					_v20 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x1d4)) + 8));
					while(_v16 < _v20) {
						_v28 = E00423584( *((intOrPtr*)(_v8 + 0x1d4)), _v16);
						if( *((char*)(_v28 + 0x57)) == 0 || ( *(_v28 + 0x1c) & 0x00000010) != 0 && ( *(_v28 + 0x55) & 0x00000008) != 0) {
							if(( *(_v28 + 0x1c) & 0x00000010) == 0 || ( *(_v28 + 0x55) & 0x00000008) != 0 || ( *(_v28 + 0x51) & 0x00000004) != 0) {
								goto L19;
							} else {
								goto L15;
							}
						} else {
							L15:
							E00409158( *((intOrPtr*)(_v28 + 0x40)),  *((intOrPtr*)(_v28 + 0x40)) +  *(_v28 + 0x48),  *((intOrPtr*)(_v28 + 0x44)),  &_v44,  *((intOrPtr*)(_v28 + 0x44)) +  *(_v28 + 0x4c));
							if(RectVisible(_v12,  &_v44) == 0) {
								goto L19;
							} else {
								if(( *(_v8 + 0x54) & 0x00000080) != 0) {
									 *(_v28 + 0x54) =  *(_v28 + 0x54) | 0x00000080;
								}
								_v24 = SaveDC(_v12);
								_push(_t262);
								_push(0x46129d);
								_push( *[fs:eax]);
								 *[fs:eax] = _t265;
								E00459688(_v12,  *((intOrPtr*)(_v28 + 0x44)),  *((intOrPtr*)(_v28 + 0x40)));
								IntersectClipRect(_v12, 0, 0,  *(_v28 + 0x48),  *(_v28 + 0x4c));
								E0045C4F0(_v28, _v12, 0xf, 0); // executed
								_pop(_t248);
								 *[fs:eax] = _t248;
								_push(0x4612a4);
								return RestoreDC(_v12, _v24);
							}
						}
						goto L33;
						L19:
						_v16 = _v16 + 1;
					}
					goto L20;
				}
				L33:
			}

0x004610f1
0x004610f3
0x004610f9
0x004610fb
0x004610fe
0x0046110b
0x00461133
0x00461133
0x00461136
0x00461139
0x00461141
0x004612bc
0x004612bf
0x004612c7
0x004612d0
0x004612d3
0x004612d9
0x004612da
0x004612e1
0x004612ed
0x004612f2
0x004612fb
0x0046130f
0x0046131b
0x00000000
0x00000000
0x00461335
0x00461335
0x00461345
0x00461361
0x0046136e
0x00461374
0x00461389
0x004613a5
0x004613b2
0x004613b8
0x004613b8
0x0046130f
0x004613bd
0x004613c0
0x004613c0
0x004612e1
0x004612d3
0x004613cd
0x00461147
0x00461149
0x0046114e
0x00461157
0x0046115e
0x00461162
0x00461162
0x0046115e
0x00461171
0x0046117a
0x00461191
0x0046119b
0x004611b6
0x00000000
0x00000000
0x00000000
0x00000000
0x004611d6
0x004611d6
0x004611fb
0x0046120f
0x00000000
0x00461215
0x0046121c
0x00461221
0x00461221
0x00461230
0x00461235
0x00461236
0x0046123b
0x0046123e
0x00461250
0x0046126b
0x0046127d
0x00461284
0x00461287
0x0046128a
0x0046129c
0x0046129c
0x0046120f
0x00000000
0x004612ad
0x004612ad
0x004612b3
0x00000000
0x0046117a
0x00000000

APIs

RectVisible.GDI32(?,?,?,?), ref: 00461208
SaveDC.GDI32(?,?,?,?,?), ref: 0046122B
IntersectClipRect.GDI32(?,00000000,00000000,?,?,00000000,0046129D,?,?,?,?,?,?), ref: 0046126B
RestoreDC.GDI32(?,0046108A,004612A4,00000000,?,?,00000000,0046129D,?,?,?,?,?,?), ref: 00461297

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 1976014923-0
Opcode ID: 0194417f71c225bcc1ed09fd4f43a804c0bec7ee46eb30d1abe60ff55584c7c4
Instruction ID: 0b809c09bd8eb78efd315c08dd1e26acb257c4418a20286bf24f8928ede44e07
Opcode Fuzzy Hash: 0194417f71c225bcc1ed09fd4f43a804c0bec7ee46eb30d1abe60ff55584c7c4
Instruction Fuzzy Hash: 9391DB70A002499FDB44DB99C485FEE7BF4AF49314F1840AAE944EB362E778DD84CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004744B8, Relevance: 15.1, APIs: 10, Instructions: 133
windowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E004744B8(intOrPtr* __eax, signed char __edx) {
				long _v12;
				long _v16;
				long _v20;
				intOrPtr* _t22;
				char* _t59;
				long _t69;
				void* _t74;
				int _t80;
				intOrPtr* _t85;
				long* _t88;

				_t22 = __eax;
				_t88 =  &_v12;
				_t85 = __eax;
				if(__edx ==  *(__eax + 0x281)) {
					L17:
					return _t22;
				}
				 *(__eax + 0x281) = __edx;
				if( *((char*)(__eax + 0x268)) == 0) {
					L4:
					_t80 = 0;
					L6:
					E00471FDC(_t85, _t80);
					_t22 = E00463E54(_t85);
					if(_t22 == 0) {
						goto L17;
					}
					if(( *(_t85 + 0x1c) & 0x00000010) == 0) {
						L10:
						_v20 = GetWindowLongW(E00463AA8(_t85), 0xfffffff0);
						_v16 = GetWindowLongW(E00463AA8(_t85), 0xffffffec);
						_v12 = GetClassLongW(E00463AA8(_t85), 0xffffffe6);
						_push( &_v12);
						E004042A8(_t85, _t96);
						E004042A8(_t85, _t96);
						SetWindowLongW(E00463AA8(_t85), 0xfffffff0,  *_t88);
						SetWindowLongW(E00463AA8(_t85), 0xffffffec, _v20);
						SetClassLongW(E00463AA8(_t85), 0xffffffe6, _v16);
						if(E00463E54(_t85) != 0) {
							_t59 =  *0x505cc4; // 0x50c0e4
							if( *_t59 != 0) {
								if( *((char*)(_t85 + 0x281)) == 3) {
									SendMessageW(E00463AA8(_t85), 0x80, 1, 0);
								} else {
									_t69 = E00476608(_t85);
									SendMessageW(E00463AA8(_t85), 0x80, 1, _t69); // executed
								}
							}
							GetSystemMenu(E00463AA8(_t85), 0xffffffff);
							E0045C4F0(_t85, 0, 0x81, 0); // executed
						}
						SetWindowPos(E00463AA8(_t85), 0, 0, 0, 0, 0, 0x37);
						return  *((intOrPtr*)( *_t85 + 0x80))();
					}
					if(( *(_t85 + 0x1c) & 0x00000010) == 0) {
						goto L17;
					}
					_t96 =  *((intOrPtr*)(_t85 + 0x30));
					if( *((intOrPtr*)(_t85 + 0x30)) == 0) {
						goto L17;
					}
					goto L10;
				}
				_t74 = ( *(__eax + 0x281) & 0x000000ff) - 2;
				if(_t74 == 0 || _t74 == 3) {
					_t80 = 1;
					goto L6;
				} else {
					goto L4;
				}
			}

0x004744b8
0x004744ba
0x004744bd
0x004744c5
0x00474654
0x00474654
0x00474654
0x004744cb
0x004744d8
0x004744e9
0x004744e9
0x004744ef
0x004744f1
0x004744f8
0x004744ff
0x00000000
0x00000000
0x00474509
0x0047451f
0x0047452e
0x00474540
0x00474553
0x0047455b
0x0047456a
0x0047457b
0x0047458e
0x004745a2
0x004745b6
0x004745c4
0x004745c6
0x004745ce
0x004745d7
0x00474608
0x004745d9
0x004745db
0x004745f0
0x004745f0
0x004745d7
0x00474617
0x00474627
0x00474627
0x00474640
0x00000000
0x00474649
0x0047450f
0x00000000
0x00000000
0x00474515
0x00474519
0x00000000
0x00000000
0x00000000
0x00474519
0x004744e1
0x004744e3
0x004744ed
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetWindowLongW.USER32(00000000,000000F0), ref: 00474529
GetWindowLongW.USER32(00000000,000000EC,00000000,000000F0), ref: 0047453B
GetClassLongW.USER32(00000000,000000E6,00000000,000000EC,00000000,000000F0), ref: 0047454E
SetWindowLongW.USER32(00000000,000000F0,00000000,?,00000000,000000E6,00000000,000000EC,00000000,000000F0), ref: 0047458E
SetWindowLongW.USER32(00000000,000000EC,?,00000000,000000F0,00000000,?,00000000,000000E6,00000000,000000EC,00000000,000000F0), ref: 004745A2
SetClassLongW.USER32(00000000,000000E6,?,00000000,000000EC,?,00000000,000000F0,00000000,?,00000000,000000E6,00000000,000000EC,00000000,000000F0), ref: 004745B6
SendMessageW.USER32(00000000,00000080,00000001,00000000,00000000,000000E6,?,00000000,000000EC,?,00000000,000000F0,00000000,?,00000000,000000E6), ref: 004745F0
SendMessageW.USER32(00000000,00000080,00000001,00000000,00000000,000000E6,?,00000000,000000EC,?,00000000,000000F0,00000000,?,00000000,000000E6), ref: 00474608
GetSystemMenu.USER32(00000000,000000FF,00000000,000000E6,?,00000000,000000EC,?,00000000,000000F0,00000000,?,00000000,000000E6,00000000,000000EC), ref: 00474617
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000037,00000000,000000E6,?,00000000,000000EC,?,00000000,000000F0,00000000), ref: 00474640

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Long$Window$ClassMessageSend$MenuSystem
String ID:
API String ID: 494549727-0
Opcode ID: edb2ada643ff25feb286b78d51e80dc5ff2c780aaf87c78a1dc2dd1a045108b6
Instruction ID: b66e1a698636c8c5f88f15e64448208dc174bc3f687025fa23ef84ff5ed881d5
Opcode Fuzzy Hash: edb2ada643ff25feb286b78d51e80dc5ff2c780aaf87c78a1dc2dd1a045108b6
Instruction Fuzzy Hash: F841F6607082813ADA11BB7E8C46BBE664D1FC1319F08861BF594AB2D2DB7C8D01E35A

Uniqueness

Uniqueness Score: -1.00%

Function 0047A8C0, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 150
comwindowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0047A8C0(void* __ecx, char __edx) {
				char _v5;
				short _v518;
				void* __ebx;
				void* __ebp;
				intOrPtr _t52;
				signed int _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				struct HINSTANCE__** _t69;
				intOrPtr _t74;
				struct HINSTANCE__** _t78;
				void* _t82;
				short* _t84;
				intOrPtr _t90;
				signed int _t91;
				intOrPtr _t98;
				intOrPtr* _t105;
				intOrPtr* _t106;
				intOrPtr _t108;
				void* _t109;
				char _t111;
				intOrPtr _t123;
				void* _t125;
				void* _t126;

				_t111 = __edx;
				_t109 = __ecx;
				if(__edx != 0) {
					_t126 = _t126 + 0xfffffff0;
					_t52 = E004044D0(_t52, _t125);
				}
				_v5 = _t111;
				_t108 = _t52;
				E0042ACC4(_t109, 0);
				_t55 =  *0x5059e0; // 0x507040
				if( *_t55 == 0) {
					_push(0); // executed
					L0041516C(); // executed
					 *((char*)(_t108 + 0x17c)) = _t55 & 0xffffff00 | (_t55 & 0x80000000) == 0x00000000;
				}
				_t56 =  *0x505d5c; // 0x503ea4
				if( *((short*)(_t56 + 2)) == 0) {
					_t106 =  *0x505d5c; // 0x503ea4
					 *((intOrPtr*)(_t106 + 4)) = _t108;
					 *_t106 = 0x47c87c;
				}
				_t57 =  *0x505e88; // 0x503eac
				if( *((short*)(_t57 + 2)) == 0) {
					_t105 =  *0x505e88; // 0x503eac
					 *((intOrPtr*)(_t105 + 4)) = _t108;
					 *_t105 = E0047CA8C;
				}
				 *((char*)(_t108 + 0x31)) = 0;
				_t123 = E00430BF4(1);
				 *((intOrPtr*)(_t108 + 0x38)) = _t123;
				 *((intOrPtr*)(_t123 + 0xc)) = _t108;
				 *((intOrPtr*)(_t123 + 8)) = 0x47cf10;
				 *((intOrPtr*)(_t108 + 0x8c)) = E00404068(1);
				 *((intOrPtr*)(_t108 + 0xac)) = E00404068(1);
				 *((intOrPtr*)(_t108 + 0x5c)) = 0;
				 *((intOrPtr*)(_t108 + 0x80)) = 0;
				 *((intOrPtr*)(_t108 + 0x58)) = 0xff000018;
				 *((intOrPtr*)(_t108 + 0x74)) = 0x1f4;
				 *((char*)(_t108 + 0x78)) = 1;
				 *((intOrPtr*)(_t108 + 0x7c)) = 0;
				 *((intOrPtr*)(_t108 + 0x70)) = 0x9c4;
				 *((char*)(_t108 + 0x84)) = 0;
				 *((char*)(_t108 + 0xa1)) = 1;
				 *((char*)(_t108 + 0xb8)) = 1;
				 *((intOrPtr*)(_t108 + 0x9c)) = E00436E64(1);
				_t69 =  *0x505bc8; // 0x507038
				E00437268(_t68, LoadIconW( *_t69, L"MAINICON"));
				_t28 = _t108 + 0x9c; // 0x1e840047
				_t74 =  *_t28;
				 *((intOrPtr*)(_t74 + 0x14)) = _t108;
				 *((intOrPtr*)(_t74 + 0x10)) = 0x47d1c0;
				 *((intOrPtr*)(_t108 + 0x94)) = E00404068(1);
				_t78 =  *0x505bc8; // 0x507038
				GetModuleFileNameW( *_t78,  &_v518, 0x100);
				_t82 = E0040E078(0x5c);
				_t134 = _t82;
				if(_t82 != 0) {
					_t34 = _t82 + 2; // 0x2
					E0040DE08( &_v518, _t34, _t134);
				}
				_t84 = E0040E060( &_v518, 0x2e);
				if(_t84 != 0) {
					 *_t84 = 0;
				}
				CharLowerW(CharNextW( &_v518));
				_t38 = _t108 + 0x88; // 0x470aa0
				E00406640(_t38, 0x100,  &_v518);
				_t90 = E00470F8C(0x47c24c, _t108); // executed
				 *((intOrPtr*)(_t108 + 0x178)) = _t90;
				 *((char*)(_t108 + 0xcc)) = 0;
				_t91 =  *0x5059e0; // 0x507040
				if( *_t91 == 0) {
					E0047AC88(_t108, _t108, 0x100); // executed
				}
				 *((char*)(_t108 + 0x55)) = 1;
				 *((char*)(_t108 + 0x56)) = 1;
				 *((char*)(_t108 + 0x57)) = 1;
				 *((char*)(_t108 + 0xa2)) = 1;
				 *((char*)(_t108 + 0xcd)) = 0;
				 *((char*)(_t108 + 0xd8)) = 0;
				 *((intOrPtr*)(_t108 + 0xd0)) = 0;
				 *((char*)(_t108 + 0xcf)) = 0;
				 *((intOrPtr*)(_t108 + 0xa4)) = 0;
				E0047D3E8(_t108, 0x100);
				E0047DFAC(_t108);
				_t98 = _t108;
				if(_v5 != 0) {
					E00404528(_t98);
					_pop( *[fs:0x0]);
				}
				return _t108;
			}

0x0047a8c0
0x0047a8c0
0x0047a8cd
0x0047a8cf
0x0047a8d2
0x0047a8d2
0x0047a8d7
0x0047a8da
0x0047a8e0
0x0047a8e5
0x0047a8ed
0x0047a8ef
0x0047a8f1
0x0047a8fe
0x0047a8fe
0x0047a904
0x0047a90e
0x0047a910
0x0047a915
0x0047a918
0x0047a918
0x0047a91e
0x0047a928
0x0047a92a
0x0047a92f
0x0047a932
0x0047a932
0x0047a938
0x0047a948
0x0047a94a
0x0047a94d
0x0047a950
0x0047a963
0x0047a975
0x0047a97d
0x0047a982
0x0047a988
0x0047a98f
0x0047a996
0x0047a99c
0x0047a99f
0x0047a9a6
0x0047a9ad
0x0047a9b4
0x0047a9c9
0x0047a9d4
0x0047a9e5
0x0047a9ea
0x0047a9ea
0x0047a9f0
0x0047a9f3
0x0047aa06
0x0047aa18
0x0047aa20
0x0047aa2f
0x0047aa34
0x0047aa36
0x0047aa38
0x0047aa41
0x0047aa41
0x0047aa50
0x0047aa57
0x0047aa59
0x0047aa59
0x0047aa6b
0x0047aa70
0x0047aa81
0x0047aa8c
0x0047aa91
0x0047aa97
0x0047aa9e
0x0047aaa6
0x0047aaaa
0x0047aaaa
0x0047aaaf
0x0047aab3
0x0047aab7
0x0047aabb
0x0047aac2
0x0047aac9
0x0047aad2
0x0047aad8
0x0047aae1
0x0047aae9
0x0047aaf0
0x0047aaf5
0x0047aafb
0x0047aafd
0x0047ab02
0x0047ab09
0x0047ab13

APIs

OleInitialize.OLE32(00000000,?,?,?,004697C8,00000000,00000000,?,00000000,?,00000000,00469843), ref: 0047A8F1
LoadIconW.USER32(00400000,MAINICON,?,?,?,004697C8,00000000,00000000,?,00000000,?,00000000,00469843), ref: 0047A9DC
GetModuleFileNameW.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,004697C8,00000000,00000000,?,00000000,?,00000000,00469843), ref: 0047AA20
CharNextW.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,004697C8,00000000,00000000,?,00000000,?,00000000), ref: 0047AA65
CharLowerW.USER32(00000000,?,00400000,?,00000100,00400000,MAINICON,?,?,?,004697C8,00000000,00000000,?,00000000,?), ref: 0047AA6B

Part of subcall function 0047AC88: GetClassInfoW.USER32(00400000,0047A8A4,?,0047B544,00470A18), ref: 0047ACEA
Part of subcall function 0047AC88: RegisterClassW.USER32(00504DA4,00400000,0047A8A4,?,0047B544,00470A18), ref: 0047AD02
Part of subcall function 0047AC88: SetWindowLongW.USER32(8840C01B,000000FC,56022444,00000000,00400000,00000000,00000000,00000000,00000000,00000000), ref: 0047ADA2
Part of subcall function 0047AC88: SendMessageW.USER32(8840C01B,00000080,00000001,00000000,8840C01B,000000FC,56022444,00000000,00400000,00000000,00000000,00000000,00000000,00000000), ref: 0047ADC7

Strings

@pP, xrefs: 0047A8E5, 0047AA9E
MAINICON, xrefs: 0047A9CF
8pP, xrefs: 0047A9D4, 0047AA18

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CharClass$FileIconInfoInitializeLoadLongLowerMessageModuleNameNextRegisterSendWindow
String ID: 8pP$@pP$MAINICON
API String ID: 896494604-2036145729
Opcode ID: 1d21e3e272ed3fd096ac0cbba7c5d96fd0b141f7d7bb182620213feb9085ba42
Instruction ID: b2b983f8f60250363d83b732902a6077ad389ccd2f514a2f84a77ab438cbd9f6
Opcode Fuzzy Hash: 1d21e3e272ed3fd096ac0cbba7c5d96fd0b141f7d7bb182620213feb9085ba42
Instruction Fuzzy Hash: 9E613E70A043408FDB50EF29C885B8A7BE4AF55308F4584BAE84CDF397D7B99948CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0045FA14, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 134
registryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E0045FA14(intOrPtr* __eax, intOrPtr __ebx, void* __edi, void* __esi) {
				short _v132;
				struct _WNDCLASSW _v172;
				intOrPtr _v180;
				signed char _v201;
				void* _v208;
				struct _WNDCLASSW _v248;
				char _v252;
				char _v256;
				char _v260;
				int _t52;
				void* _t53;
				intOrPtr _t86;
				intOrPtr _t105;
				intOrPtr _t109;
				void* _t110;
				intOrPtr* _t112;
				void* _t116;

				_t110 = __edi;
				_t94 = __ebx;
				_push(__ebx);
				_push(__esi);
				_v260 = 0;
				_t112 = __eax;
				_push(_t116);
				_push(0x45fbf3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t116 + 0xffffff00;
				 *((intOrPtr*)( *__eax + 0x9c))();
				if(_v180 != 0 || (_v201 & 0x00000040) == 0) {
					L7:
					 *((intOrPtr*)(_t112 + 0x248)) = _v172.lpfnWndProc;
					_t52 = GetClassInfoW(_v172.hInstance,  &_v132,  &_v248);
					asm("sbb eax, eax");
					_t53 = _t52 + 1;
					if(_t53 == 0 || E004577C4 != _v248.lpfnWndProc) {
						if(_t53 != 0) {
							UnregisterClassW( &_v132, _v172.hInstance);
						}
						_v172.lpfnWndProc = E004577C4;
						_v172.lpszClassName =  &_v132;
						if(RegisterClassW( &_v172) == 0) {
							E0041362C();
						}
					}
					 *0x504abc = _t112;
					_t96 =  *_t112; // executed
					 *((intOrPtr*)( *_t112 + 0xa0))();
					if( *(_t112 + 0x24c) == 0) {
						E0041362C();
					}
					if((GetWindowLongW( *(_t112 + 0x24c), 0xfffffff0) & 0x40000000) != 0 && GetWindowLongW( *(_t112 + 0x24c), 0xfffffff4) == 0) {
						SetWindowLongW( *(_t112 + 0x24c), 0xfffffff4,  *(_t112 + 0x24c));
					}
					E0040E1CC( *((intOrPtr*)(_t112 + 0x16c)));
					 *((intOrPtr*)(_t112 + 0x16c)) = 0;
					E00463E60(_t112);
					E0045C4F0(_t112, E00430E20( *((intOrPtr*)(_t112 + 0x64)), _t94, _t96, _t110, _t112), 0x30, 1); // executed
					_t131 =  *((char*)(_t112 + 0x5c));
					if( *((char*)(_t112 + 0x5c)) != 0) {
						E004042A8(_t112, _t131);
					}
					_pop(_t105);
					 *[fs:eax] = _t105;
					_push(0x45fbfa);
					return L00406438( &_v260);
				} else {
					_t94 =  *((intOrPtr*)(__eax + 4));
					if(_t94 == 0 || ( *(_t94 + 0x1c) & 0x00000002) == 0) {
						L6:
						_v256 =  *((intOrPtr*)(_t112 + 8));
						_v252 = 0x11;
						_push( &_v256);
						_t86 =  *0x505eb8; // 0x42e46c
						E00408D5C(_t86,  &_v260, 0);
						E004119DC(_t94, _v260, 1, _t110, _t112);
						E00404A74();
					} else {
						_t109 =  *0x456270; // 0x4562c8
						if(E00404238(_t94, _t109) == 0) {
							goto L6;
						}
						_v180 = E00463AA8(_t94);
					}
					goto L7;
				}
			}

0x0045fa14
0x0045fa14
0x0045fa1d
0x0045fa1e
0x0045fa21
0x0045fa27
0x0045fa2b
0x0045fa2c
0x0045fa31
0x0045fa34
0x0045fa41
0x0045fa4e
0x0045fac6
0x0045facc
0x0045fae4
0x0045faec
0x0045faee
0x0045faf1
0x0045fb02
0x0045fb0f
0x0045fb0f
0x0045fb14
0x0045fb21
0x0045fb36
0x0045fb38
0x0045fb38
0x0045fb36
0x0045fb3d
0x0045fb4b
0x0045fb4d
0x0045fb5a
0x0045fb5c
0x0045fb5c
0x0045fb74
0x0045fb92
0x0045fb92
0x0045fb9d
0x0045fba4
0x0045fbac
0x0045fbc4
0x0045fbc9
0x0045fbcd
0x0045fbd5
0x0045fbd5
0x0045fbdc
0x0045fbdf
0x0045fbe2
0x0045fbf2
0x0045fa59
0x0045fa59
0x0045fa5e
0x0045fa86
0x0045fa89
0x0045fa8f
0x0045fa9c
0x0045faa5
0x0045faaa
0x0045fabc
0x0045fac1
0x0045fa66
0x0045fa68
0x0045fa75
0x00000000
0x00000000
0x0045fa7e
0x0045fa7e
0x00000000
0x0045fa5e

APIs

GetClassInfoW.USER32(?,?,?,?,?,?,?,00442BD3,00000000,00442BEB), ref: 0045FAE4
UnregisterClassW.USER32(?,?,?,?,?,?,?,?,?,00442BD3,00000000,00442BEB), ref: 0045FB0F
RegisterClassW.USER32(?,?,?,?,?,?,?,?,00442BD3,00000000,00442BEB), ref: 0045FB2E
GetWindowLongW.USER32(00000000,000000F0,?,?,?,?,00442BD3,00000000,00442BEB), ref: 0045FB6A
GetWindowLongW.USER32(00000000,000000F4,00000000,000000F0,?,?,?,?,00442BD3,00000000,00442BEB), ref: 0045FB7F
SetWindowLongW.USER32(00000000,000000F4,00000000,00000000,000000F4,00000000,000000F0,?,?,?,?,00442BD3,00000000,00442BEB), ref: 0045FB92

Strings

@, xrefs: 0045FA50
lB, xrefs: 0045FAA5

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ClassLongWindow$InfoRegisterUnregister
String ID: @$lB
API String ID: 717780171-2420076385
Opcode ID: 823d6c247227aa385989c75d7e8cdf10b872643b57611a752494db4ae512df4f
Instruction ID: 04ed6856cf25309993ad0e4cc423f80ed7ff61906970733f7d4d6221bb96fa22
Opcode Fuzzy Hash: 823d6c247227aa385989c75d7e8cdf10b872643b57611a752494db4ae512df4f
Instruction Fuzzy Hash: B751A570A002589FDB20DB69CC41B9A77E9AF45309F1045BAF849D7392D738AD48CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00479E24, Relevance: 13.6, APIs: 9, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00479E24(void* __eax, void* __ebx, void* __ecx, void* __esi) {
				signed char _v5;
				struct tagLOGFONTW _v100;
				struct tagLOGFONTW _v192;
				struct tagLOGFONTW _v284;
				struct tagLOGFONTW _v376;
				void _v600;
				void* _t27;
				int _t31;
				void* _t34;
				void* _t37;
				intOrPtr _t47;
				struct HFONT__* _t50;
				struct HFONT__* _t54;
				struct HFONT__* _t58;
				struct HFONT__* _t62;
				intOrPtr _t65;
				intOrPtr _t67;
				void* _t70;
				intOrPtr _t81;
				void* _t92;
				void* _t93;
				intOrPtr _t94;

				_t92 = _t93;
				_t94 = _t93 + 0xfffffdac;
				_t70 = __eax;
				_v5 = 0;
				if( *0x50c17c != 0) {
					_t67 =  *0x50c17c; // 0x0
					_v5 =  *(_t67 + 0x84) & 0x000000ff;
				}
				_push(_t92);
				_push(0x479f9f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t94;
				if( *0x50c17c != 0) {
					_t65 =  *0x50c17c; // 0x0
					E0047CEB8(_t65, 0);
				}
				if(SystemParametersInfoW(0x1f, 0x5c,  &_v100, 0) == 0) {
					_t27 = GetStockObject(0xd);
					_t7 = _t70 + 0x7c; // 0x61727241
					E0043103C( *_t7, _t27);
				} else {
					_t62 = CreateFontIndirectW( &_v100);
					_t6 = _t70 + 0x7c; // 0x61727241
					E0043103C( *_t6, _t62);
				}
				_v600 = 0x1f4;
				_t31 = SystemParametersInfoW(0x29, 0,  &_v600, 0); // executed
				if(_t31 == 0) {
					_t16 = _t70 + 0x78; // 0x6d726f46
					E00431170( *_t16, 8);
					_t34 = GetStockObject(0xd);
					_t17 = _t70 + 0x80; // 0xc79
					E0043103C( *_t17, _t34);
					_t37 = GetStockObject(0xd);
					_t18 = _t70 + 0x84; // 0x0
					E0043103C( *_t18, _t37);
				} else {
					_t50 = CreateFontIndirectW( &_v284);
					_t11 = _t70 + 0x78; // 0x6d726f46
					E0043103C( *_t11, _t50);
					_t54 = CreateFontIndirectW( &_v376);
					_t13 = _t70 + 0x80; // 0xc79
					E0043103C( *_t13, _t54);
					_t58 = CreateFontIndirectW( &_v192);
					_t15 = _t70 + 0x84; // 0x0
					E0043103C( *_t15, _t58);
				}
				_t19 = _t70 + 0x78; // 0x6d726f46
				E00430DE0( *_t19, 0xff000017);
				_t20 = _t70 + 0x80; // 0xc79
				E00430DE0( *_t20, 0xff000007);
				_t21 = _t70 + 0x84; // 0x0
				E00430DE0( *_t21, 0xff000008);
				_pop(_t81);
				 *[fs:eax] = _t81;
				_push(0x479fa6);
				if( *0x50c17c != 0) {
					_t47 =  *0x50c17c; // 0x0
					return E0047CEB8(_t47, _v5 & 0x000000ff);
				}
				return 0;
			}

0x00479e25
0x00479e27
0x00479e2f
0x00479e31
0x00479e3c
0x00479e3e
0x00479e4a
0x00479e4a
0x00479e4f
0x00479e50
0x00479e55
0x00479e58
0x00479e62
0x00479e66
0x00479e6b
0x00479e6b
0x00479e85
0x00479e9e
0x00479ea5
0x00479ea8
0x00479e87
0x00479e8b
0x00479e92
0x00479e95
0x00479e95
0x00479eb2
0x00479ec5
0x00479ecc
0x00479f18
0x00479f20
0x00479f27
0x00479f2e
0x00479f34
0x00479f3b
0x00479f42
0x00479f48
0x00479ece
0x00479ed5
0x00479edc
0x00479edf
0x00479eeb
0x00479ef2
0x00479ef8
0x00479f04
0x00479f0b
0x00479f11
0x00479f11
0x00479f4d
0x00479f55
0x00479f5a
0x00479f65
0x00479f6a
0x00479f75
0x00479f7c
0x00479f7f
0x00479f82
0x00479f8e
0x00479f94
0x00000000
0x00479f99
0x00479f9e

APIs

SystemParametersInfoW.USER32(0000001F,0000005C,?,00000000,00000000,00479F9F,?,00000000,004708FC,?,00479578,?,?,00000000,?,004697B2), ref: 00479E7E
CreateFontIndirectW.GDI32(0000005C,0000001F,0000005C,?,00000000,00000000,00479F9F,?,00000000,004708FC,?,00479578,?,?,00000000), ref: 00479E8B
GetStockObject.GDI32(0000000D,0000001F,0000005C,?,00000000,00000000,00479F9F,?,00000000,004708FC,?,00479578,?,?,00000000), ref: 00479E9E

Part of subcall function 00431170: MulDiv.KERNEL32(00000000,?,00000048,?,?,00430D2C,00000000,00430D42,?,00000000,00430D5F), ref: 0043117D

SystemParametersInfoW.USER32(00000029,00000000,?,00000000,0000000D,0000001F,0000005C,?,00000000,00000000,00479F9F,?,00000000,004708FC,?,00479578), ref: 00479EC5
CreateFontIndirectW.GDI32(?,00000029,00000000,?,00000000,0000000D,0000001F,0000005C,?,00000000,00000000,00479F9F,?,00000000,004708FC), ref: 00479ED5
CreateFontIndirectW.GDI32(?,?,00000029,00000000,?,00000000,0000000D,0000001F,0000005C,?,00000000,00000000,00479F9F,?,00000000,004708FC), ref: 00479EEB
CreateFontIndirectW.GDI32(?,?,?,00000029,00000000,?,00000000,0000000D,0000001F,0000005C,?,00000000,00000000,00479F9F,?,00000000), ref: 00479F04
GetStockObject.GDI32(0000000D,00000029,00000000,?,00000000,0000000D,0000001F,0000005C,?,00000000,00000000,00479F9F,?,00000000,004708FC), ref: 00479F27
GetStockObject.GDI32(0000000D,0000000D,00000029,00000000,?,00000000,0000000D,0000001F,0000005C,?,00000000,00000000,00479F9F,?,00000000,004708FC), ref: 00479F3B

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFontIndirect$ObjectStock$InfoParametersSystem
String ID:
API String ID: 2565622021-0
Opcode ID: c6847f69a407f8d23a479656479342d4f5398e729416428b2752663ed1b5ee9d
Instruction ID: 14aa0f4ff4f7bc0727a57009f0125ca654d45a995d27ce52bc3472b3cbb67e88
Opcode Fuzzy Hash: c6847f69a407f8d23a479656479342d4f5398e729416428b2752663ed1b5ee9d
Instruction Fuzzy Hash: 2E4172307042449BEB50EB75CD42B9A37F4AB49304F5481BBB948DB3A7DA389C45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004C4F68, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 142
windowCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E004C4F68(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				long _v8;
				struct _SHFILEINFOW _v700;
				char _v704;
				long _t62;
				long _t77;
				void* _t80;
				intOrPtr* _t86;
				short* _t92;
				void* _t93;
				void* _t94;
				void* _t98;
				void* _t99;
				intOrPtr _t115;
				intOrPtr _t116;
				void* _t132;
				void* _t133;
				intOrPtr _t134;

				_t130 = __esi;
				_t129 = __edi;
				_t132 = _t133;
				_t134 = _t133 + 0xfffffd44;
				_push(__esi);
				_push(__edi);
				_v704 = 0;
				_v8 = 0;
				_push(_t132);
				_push(0x4c515e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t134;
				E0045A7F0( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x4b0)), 0x20);
				E0045A824( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x4b0)), 0x20);
				E0045A7F0( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x4b4)), 0x20);
				E0045A824( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x4b4)), 0x20);
				_push(_t132);
				_push(0x4c5133);
				_push( *[fs:eax]);
				 *[fs:eax] = _t134;
				_t62 = SHGetFileInfoW(L"c:\\directory", 0x10,  &_v700, 0x2b4, 0x1010); // executed
				if(_t62 != 0 && _v700.szDisplayName != 0) {
					_t98 =  *0x509b50; // 0x400000
					_t99 = ExtractIconW(_t98,  &(_v700.szDisplayName), _v700.iIcon); // executed
					E004C4EA4(_t99,  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x4b0)), __edi);
				}
				if(E004DAEF4(6, 0) == 0) {
					E004E06EC(0, 2, _t129, _t130, __eflags,  &_v8);
					__eflags = _v8;
					if(_v8 == 0) {
						__eflags = 0;
						E004E06EC(1, 2, _t129, _t130, 0,  &_v8);
					}
					__eflags = _v8;
					if(_v8 != 0) {
						_t77 = SHGetFileInfoW(E004064D4(_v8), 0,  &_v700, 0x2b4, 0x1000);
						__eflags = _t77;
						if(_t77 != 0) {
							__eflags = _v700.szDisplayName;
							if(_v700.szDisplayName != 0) {
								_t80 =  *0x509b50; // 0x400000
								E004C4EA4(ExtractIconW(_t80,  &(_v700.szDisplayName), _v700.iIcon),  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x4b4)), _t129);
							}
						}
					}
				} else {
					_t86 =  *0x506064; // 0x50cdd0
					E0047E328( *_t86,  &_v704);
					E00406854( &_v704, L"shell32.dll", 0x27);
					_t92 = E004064D4(_v704);
					_t93 =  *0x509b50; // 0x400000
					_t94 = ExtractIconW(_t93, _t92, ??); // executed
					E004C4EA4(_t94,  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x4b4)), _t129);
				}
				_pop(_t115);
				 *[fs:eax] = _t115;
				_pop(_t116);
				 *[fs:eax] = _t116;
				_push(E004C5165);
				L00406438( &_v704);
				return L00406438( &_v8);
			}

0x004c4f68
0x004c4f68
0x004c4f69
0x004c4f6b
0x004c4f72
0x004c4f73
0x004c4f76
0x004c4f7c
0x004c4f81
0x004c4f82
0x004c4f87
0x004c4f8a
0x004c4f9e
0x004c4fb4
0x004c4fca
0x004c4fe0
0x004c4fe7
0x004c4fe8
0x004c4fed
0x004c4ff0
0x004c500b
0x004c5012
0x004c502c
0x004c5032
0x004c5043
0x004c5043
0x004c5053
0x004c50b0
0x004c50b5
0x004c50b9
0x004c50bf
0x004c50c5
0x004c50c5
0x004c50ca
0x004c50ce
0x004c50ec
0x004c50f1
0x004c50f3
0x004c50f5
0x004c50fd
0x004c510d
0x004c5124
0x004c5124
0x004c50fd
0x004c50f3
0x004c5055
0x004c505d
0x004c5064
0x004c5074
0x004c507f
0x004c5085
0x004c508b
0x004c509c
0x004c509c
0x004c512b
0x004c512e
0x004c513f
0x004c5142
0x004c5145
0x004c5150
0x004c515d

APIs

SHGetFileInfoW.SHELL32(c:\directory,00000010,?,000002B4,00001010,00000000,004C5133,?,00000000,004C515E,?,00000000,?,?,?,004C56D9), ref: 004C500B
ExtractIconW.SHELL32(00400000,00000000,?), ref: 004C5032

Part of subcall function 004C4EA4: DrawIconEx.USER32(00000000,00000000,00000000,?,00000020,00000020,00000000,00000000,00000003,?,00000020,?,?), ref: 004C4F3F
Part of subcall function 004C4EA4: DestroyIcon.USER32(?,004C4F62,?,00000020,00000020,00000000,00000000,00000003,?,00000020,?,?), ref: 004C4F55

ExtractIconW.SHELL32(00400000,00000000,00000027,c:\directory,00000010,?,000002B4,00001010,00000000,004C5133,?,00000000,004C515E,?,00000000,?), ref: 004C508B
SHGetFileInfoW.SHELL32(00000000,00000000,?,000002B4,00001000,?,c:\directory,00000010,?,000002B4,00001010,00000000,004C5133,?,00000000,004C515E), ref: 004C50EC
ExtractIconW.SHELL32(00400000,00000000,?), ref: 004C5113

Strings

shell32.dll, xrefs: 004C506F
c:\directory, xrefs: 004C5006

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Icon$Extract$FileInfo$DestroyDraw
String ID: c:\directory$shell32.dll
API String ID: 1181571048-1375355148
Opcode ID: e17d622a8174e8dc1b88aaf8ab0711a50df0a5ab08150593009d7dab6a61a4ea
Instruction ID: af43fc8acc5774025ba975d7aa79e46eda02c8c3ccf5af175c7f43f14534289e
Opcode Fuzzy Hash: e17d622a8174e8dc1b88aaf8ab0711a50df0a5ab08150593009d7dab6a61a4ea
Instruction Fuzzy Hash: EC515178A002049FDB50EB55C94AF9EB7E8EF48304F1581AAF904D7352DB38EE85CA59

Uniqueness

Uniqueness Score: -1.00%

Function 0047C300, Relevance: 12.1, APIs: 8, Instructions: 118windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000200,0000020A,00000001,?,?,?,000000EC,00000000,0047C44F), ref: 0047C31C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000,?,00000000,00000200,0000020A,00000001,?,?,?,000000EC,00000000,0047C44F), ref: 0047C334
IsWindowUnicode.USER32(?,?,00000000,00000200,0000020A,00000001,?,?,?,000000EC,00000000,0047C44F), ref: 0047C348
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001,?,00000000,00000200,0000020A,00000001,?,?,?,000000EC,00000000,0047C44F), ref: 0047C36F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001,?,00000000,00000200,0000020A,00000001,?,?,?,000000EC,00000000,0047C44F), ref: 0047C385
TranslateMessage.USER32(?,?,00000000,00000200,0000020A,00000001,?,?,?,000000EC,00000000), ref: 0047C410
DispatchMessageW.USER32(?,?,?,00000000,00000200,0000020A,00000001,?,?,?,000000EC,00000000), ref: 0047C41D
DispatchMessageA.USER32(?,?,?,00000000,00000200,0000020A,00000001,?,?,?,000000EC,00000000), ref: 0047C425

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Peek$Dispatch$TranslateUnicodeWindow
String ID:
API String ID: 2190272339-0
Opcode ID: b7632472c63cd10a1cad22dc7a9e4c5c9789c2f8e318bfee0503b2628d5330d0
Instruction ID: 437f1a318559e6c22ea0d38a56ef15dc977b799bde0b5edb6766dcaa099dde8f
Opcode Fuzzy Hash: b7632472c63cd10a1cad22dc7a9e4c5c9789c2f8e318bfee0503b2628d5330d0
Instruction Fuzzy Hash: EE31802074834065EA2166295CD2BFF67944F92708F54C02FF9C8BA2C3C7EE9847529E

Uniqueness

Uniqueness Score: -1.00%

Function 004AFDA8, Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 157COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,004AFFD8,004AFFD8,?,004AFFD8,00000000), ref: 004AFF5D
CloseHandle.KERNEL32(004FECA9,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,004AFFD8,004AFFD8,?,004AFFD8), ref: 004AFF6A

Part of subcall function 004AFD14: WaitForInputIdle.USER32(00000001,00000032,?,?,?,00000001,?,?,004B0142,?,0000003C,00000000,004B0158,?,?,?), ref: 004AFD40
Part of subcall function 004AFD14: MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF,?,?,?,00000001,?,?,004B0142,?,0000003C,00000000,004B0158), ref: 004AFD62
Part of subcall function 004AFD14: GetExitCodeProcess.KERNEL32(00000001,?,00000000,004AFD99,?,?,?,00000001,?,?,004B0142,?,0000003C,00000000,004B0158), ref: 004AFD73
Part of subcall function 004AFD14: CloseHandle.KERNEL32(00000001,004AFDA0,004AFD99,?,?,?,00000001,?,?,004B0142,?,0000003C,00000000,004B0158), ref: 004AFD93

Strings

.cmd, xrefs: 004AFE5F
.bat, xrefs: 004AFE44
cmd.exe" /C ", xrefs: 004AFE91
COMMAND.COM" /C , xrefs: 004AFEC8
D, xrefs: 004AFEFC

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 2e017c6d7da142e72624e442a671036f7e9abf26a442562e69285015e4f19b7b
Instruction ID: adfb2d5df06552d81c622209772d6262f88e085e1f232875a4f7499b514ebe84
Opcode Fuzzy Hash: 2e017c6d7da142e72624e442a671036f7e9abf26a442562e69285015e4f19b7b
Instruction Fuzzy Hash: D5514330A0020C9FDB10EFD6C882BDEB7B5AF56704F61453BB804A7292D7789E19DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00479A4C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 126registryCOMMON

Download Yara Rule

APIs

GetKeyboardLayoutList.USER32(00000040,?,00000000,00479BF9,?,00000000,?,00479C9D,00000000,?,0045E213,004604E0,?,00000000,0045E291), ref: 00479AA4
RegOpenKeyExW.ADVAPI32(80000002,00000000), ref: 00479B0C
RegQueryValueExW.ADVAPI32(?,layout text,00000000,00000000,?,00000200,00000000,00479BB5,?,80000002,00000000), ref: 00479B46
RegCloseKey.ADVAPI32(?,00479BBC,00000000,?,00000200,00000000,00479BB5,?,80000002,00000000), ref: 00479BAF

Strings

System\CurrentControlSet\Control\Keyboard Layouts\%.8x, xrefs: 00479AF6
layout text, xrefs: 00479B3D

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseKeyboardLayoutListOpenQueryValue
String ID: System\CurrentControlSet\Control\Keyboard Layouts\%.8x$layout text
API String ID: 1703357764-2652665750
Opcode ID: be28b2793e48da44fb27ed2d7e2f8cda11f6b3096dc61b3c0638962e2980ae0d
Instruction ID: 6d16dc52b15ca3da2c114d3940da450be322d21a51ad2d9045c77be107a79e00
Opcode Fuzzy Hash: be28b2793e48da44fb27ed2d7e2f8cda11f6b3096dc61b3c0638962e2980ae0d
Instruction Fuzzy Hash: C3411B74A002089FDB11DF55C981BDEB7F9FB09304F5184AAE908A7391D778AF00CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004DFE14, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,004DFF66,?,0050C17C,00000005,00000000,00000000,?,0050014D,00000000,00500305,?,00000000,00500375), ref: 004DFE9F
GetLastError.KERNEL32(00000000,00000000,00000000,004DFF66,?,0050C17C,00000005,00000000,00000000,?,0050014D,00000000,00500305,?,00000000,00500375), ref: 004DFEA8

Strings

Created temporary directory: , xrefs: 004DFE51
S&P, xrefs: 004DFEEA
\_setup64.tmp, xrefs: 004DFF1E
_isetup, xrefs: 004DFE8A

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $S&P$\_setup64.tmp$_isetup
API String ID: 1375471231-3192552327
Opcode ID: e9b022f8b10c189969b0221372b1140295dea7f6f666c78efa77b92059c7441b
Instruction ID: 8b079be37d4e4a3e0c2ced2d148871d56c1e1530df85922ca8307cfb7a8af6e1
Opcode Fuzzy Hash: e9b022f8b10c189969b0221372b1140295dea7f6f666c78efa77b92059c7441b
Instruction Fuzzy Hash: D9415575A001489BDB10EBA5D892ADEB7B5EF49308F50413BF501B7392DB38AE05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00481524, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91windowregistryCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32(00000000,00481636,?,?,000000EC,00000001,00000000,?,004B36C3,?,00000000,?,00000001,00000000,00000002,00000000), ref: 00481553
GetFocus.USER32(00000000,00481636,?,?,000000EC,00000001,00000000,?,004B36C3,?,00000000,?,00000001,00000000,00000002,00000000), ref: 0048155B
RegisterClassW.USER32(00504E00,00000000,00481636,?,?,000000EC,00000001,00000000,?,004B36C3,?,00000000,?,00000001,00000000,00000002), ref: 0048157C
ShowWindow.USER32(00000000,00000008,00000000,00400000,00000000,61736944,00000000,00000000,00000000,00000000,80000000,00000000,00400000,00000000,00000000,00000000), ref: 00481614
SetFocus.USER32(00000000,00000000,00481636,?,?,000000EC,00000001,00000000,?,004B36C3,?,00000000,?,00000001,00000000,00000002), ref: 0048161B

Strings

TWindowDisabler-Window, xrefs: 004815B3, 004815FC

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FocusWindow$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 495420250-1824977358
Opcode ID: d276ce21e6a917117893f9a108f7be6f165f941e43dcae3639deba01e5ddd386
Instruction ID: 708702829b5a56c0a03e5800366e10e6593c77c88456bdfb942bd7e73f148dda
Opcode Fuzzy Hash: d276ce21e6a917117893f9a108f7be6f165f941e43dcae3639deba01e5ddd386
Instruction Fuzzy Hash: 8E219F70A00700ABE710FF659C12F1E76A9AB45B04F15892BF504FB2E2E7B89D15C79D

Uniqueness

Uniqueness Score: -1.00%

Function 004B0520, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 149registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FDB8: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,0048048E,?,00000000,?,0048042E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0048048E), ref: 0047FDD4

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,004B06C6,?,00000000,004B0706), ref: 004B0609

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 004B0580
PendingFileRenameOperations2, xrefs: 004B05D2
WININIT.INI, xrefs: 004B0638
PendingFileRenameOperations, xrefs: 004B059C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: a853cbf542f56f86f5c71b440ac96182e7cc5964278bd54aa4f41be9adc2ca47
Instruction ID: 8b76beac86b648aabafdc11ec4e96d0ba708e3b4994c149938cbad327886d941
Opcode Fuzzy Hash: a853cbf542f56f86f5c71b440ac96182e7cc5964278bd54aa4f41be9adc2ca47
Instruction Fuzzy Hash: 5A519634A002089FDB10DF61C852ADFB7F9EB85304F50807AE805E7791EB78AE15CB68

Uniqueness

Uniqueness Score: -1.00%

Function 005025D8, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00408F4C: GetModuleHandleW.KERNEL32(00000000,?,005025EB), ref: 00408F58

GetWindowLongW.USER32(?,000000EC), ref: 005025FB
SetWindowLongW.USER32(?,000000EC,00000000,?,000000EC), ref: 0050260E
SetErrorMode.KERNEL32(00000001,00000000,00502653,?,?,000000EC,00000000,?,000000EC), ref: 00502623

Part of subcall function 00500674: GetModuleHandleW.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000,00502653,?,?,000000EC,00000000,?,000000EC), ref: 0050067E

Part of subcall function 0047C47C: SendMessageW.USER32(?,0000B020,00000000,?,?,?,00502644,005005CC,005005C0,00000001,00000000,00502653,?,?,000000EC,00000000), ref: 0047C4A1

Part of subcall function 0047BFC0: SetWindowTextW.USER32(?,00000000,00000000,?,004FF846,00000000,004FFACA,?,?,00000000,?), ref: 0047BFF0

ShowWindow.USER32(?,00000005,00000000,00502653,?,?,000000EC,00000000,?,000000EC), ref: 0050268D

Part of subcall function 0047C574: GetWindowLongW.USER32(?,000000EC,?,?), ref: 0047C650
Part of subcall function 0047C574: SetWindowLongW.USER32(?,000000EC,00000000,?,000000EC,?,?), ref: 0047C65E

Strings

Setup, xrefs: 00502673

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$HandleModule$ErrorMessageModeSendShowText
String ID: Setup
API String ID: 409482983-3839654196
Opcode ID: 039e7798b034e00fc9cc9ecb02c3961378a24bf619023d134a8e713eeea5fc81
Instruction ID: da95eccc4b7c819ae81fd41ddc2e497eeb2d2620aa935d59fe59b11c3441b361
Opcode Fuzzy Hash: 039e7798b034e00fc9cc9ecb02c3961378a24bf619023d134a8e713eeea5fc81
Instruction Fuzzy Hash: CE215A74200A009FC200EB29DC96E1E77A8FB5AB14B1141A6F908873F2DB75AC08DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00437448, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00000008,00000060,00000048,00000000,00437546), ref: 0043746E

Part of subcall function 00437404: GetDC.USER32(00000000), ref: 0043740D
Part of subcall function 00437404: SelectObject.GDI32(00000000,058A00B4,00000000), ref: 0043741F
Part of subcall function 00437404: GetTextMetricsW.GDI32(00000000,?,00000000,058A00B4,00000000), ref: 0043742A
Part of subcall function 00437404: ReleaseDC.USER32(00000000,00000000,00000000,058A00B4,00000000), ref: 0043743B

Strings

MS Shell Dlg 2, xrefs: 004374D8
Tahoma, xrefs: 00437490
pB, xrefs: 0043749C
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 004374C4

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma$pB
API String ID: 2013942131-4023867274
Opcode ID: cf2259973a50fa4fadbe7c6b46605f53089a8c2a2151c732d3f56618b11c2078
Instruction ID: 6d970ac7018f7d299bc601b79a03856cef38c1b5e20535a1d7c2246d00256cf6
Opcode Fuzzy Hash: cf2259973a50fa4fadbe7c6b46605f53089a8c2a2151c732d3f56618b11c2078
Instruction Fuzzy Hash: 0611B6B0B04204AFDB21EF6AD89295D7BE5EB4D304F91507AE44097751D739AD05CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00474B14, Relevance: 7.7, APIs: 5, Instructions: 174windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 00474C38
SetMenu.USER32(00000000,00000000), ref: 00474C55
SetMenu.USER32(00000000,00000000), ref: 00474C8A
SetMenu.USER32(00000000,00000000,00000000,00474D28), ref: 00474CA6

Part of subcall function 00408D5C: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00408DA1

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000037), ref: 00474CED

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$LoadStringWindow
String ID:
API String ID: 1738039741-0
Opcode ID: 6a60dd055f1f7ec0ba2b1360a4acf70c63cf1c8017154d842d2e612cd1fc52df
Instruction ID: 6ec96a7dec51f0ba4dc61fb4207ba700525d6d54394ab384987326c70e87ab09
Opcode Fuzzy Hash: 6a60dd055f1f7ec0ba2b1360a4acf70c63cf1c8017154d842d2e612cd1fc52df
Instruction Fuzzy Hash: 82518C30B003445FDB21AF3A88857BA6698AF81309F05847BEC899B393DB7DDC49975D

Uniqueness

Uniqueness Score: -1.00%

Function 00460F54, Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00460F7F
SaveDC.GDI32(00000000,00000000,004610B3), ref: 00460FB8
ExcludeClipRect.GDI32(00000000,?,?,?,?,00000000,00461076,?,00000000,00000000,004610B3), ref: 0046103A
RestoreDC.GDI32(00000000,?,0046107D,00000000,00000000,004610B3), ref: 00461070
EndPaint.USER32(00000000,?,004610BA), ref: 004610AD

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: e79d921e6b70b82a160c8b2ce2c75c755c5e97c0d0365474a5992475b3de9151
Instruction ID: 7a805ab21f4071e713f1e447def40b89f5db10a089ffe322c7a234b51617fada
Opcode Fuzzy Hash: e79d921e6b70b82a160c8b2ce2c75c755c5e97c0d0365474a5992475b3de9151
Instruction Fuzzy Hash: E0416F70A042849FDB14CB98C995FAEBBF5AF48304F1945AAE804977A2E779AD40CB05

Uniqueness

Uniqueness Score: -1.00%

Function 0047B21C, Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

EnumWindows.USER32(0047B128,00000000), ref: 0047B253
ShowWindow.USER32(?,00000000,0047B128,00000000), ref: 0047B28A
ShowOwnedPopups.USER32(00000000,?,0047B128,00000000), ref: 0047B2B9
ShowWindow.USER32(?,00000005), ref: 0047B321
ShowOwnedPopups.USER32(00000000,?), ref: 0047B350

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Show$OwnedPopupsWindow$EnumWindows
String ID:
API String ID: 315437064-0
Opcode ID: bfa6b281556c3ea15580ccc4805726e6f2ab5e5eb9f13c57aaaa7b1383301cae
Instruction ID: 79a4e5b3efa202bc9a0a32246b4b85f5a3cc000e9260f3bc7b7858bae2482438
Opcode Fuzzy Hash: bfa6b281556c3ea15580ccc4805726e6f2ab5e5eb9f13c57aaaa7b1383301cae
Instruction Fuzzy Hash: DD419330700A008BE7209B79C849FEA73E6EB45318F448A6BE56D972D2C73CACC5C795

Uniqueness

Uniqueness Score: -1.00%

Function 004B0DE4, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetDiskFreeSpaceExW,00000000,004B0F2D), ref: 004B0E1D

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

Strings

GetDiskFreeSpaceExW, xrefs: 004B0E13
kernel32.dll, xrefs: 004B0E18

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: 18948d4eebb6bf8ec0b21c3f4b71faa1d33054270ae7fa2ec9fa9311a97c1c4e
Instruction ID: 458e2f2286c1b757ed7f365bb57679c990424612fb602b9c6df9d1676454e2fc
Opcode Fuzzy Hash: 18948d4eebb6bf8ec0b21c3f4b71faa1d33054270ae7fa2ec9fa9311a97c1c4e
Instruction Fuzzy Hash: F7416E71E04248AFDB11DFA6C8829EFB7B8EF49304F51896AF405F3251D6789905CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004263DC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,00426524,?,?,00421538,00000001), ref: 00426438
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,00426524,?,?,00421538,00000001), ref: 00426466

Part of subcall function 0040D5CC: CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,00421538,004264A6,00000000,00426524,?,?,00421538), ref: 0040D61A

Part of subcall function 0040D884: GetFullPathNameW.KERNEL32(00000000,00000104,?,?,?,00421538,004264C1,00000000,00426524,?,?,00421538,00000001), ref: 0040D8A3

GetLastError.KERNEL32(00000000,00426524,?,?,00421538,00000001), ref: 004264CB

Part of subcall function 00410FE0: FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000100,00000000,00421538,004264D8,00000000,00426524,?,?,00421538,00000001), ref: 00410FFF

Strings

\B, xrefs: 004264F0

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID: \B
API String ID: 503785936-3556218163
Opcode ID: ab653f21cc59c0cdab273c7921e54ef674e8b2996aa92476a83c522d4712f5ea
Instruction ID: e073fde731c840115ebee6dd56ab310852e89c1c18d6a76eba9ec1173b0a5334
Opcode Fuzzy Hash: ab653f21cc59c0cdab273c7921e54ef674e8b2996aa92476a83c522d4712f5ea
Instruction Fuzzy Hash: 1F31B430B002189FDB10EBA9CC42BDEB7A1AB48318F51817AE904B73C2D77859458B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405084, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,?,00000002,004051BA,00403127,0040316E,?,00000000,?,?,?,00000000,?,00500689,00000000), ref: 004050B5
FreeLibrary.KERNEL32(00400000,?,?,?,00000002,004051BA,00403127,0040316E,?,00000000,?,?,?,00000000,?,00500689), ref: 00405156
ExitProcess.KERNEL32(00000000,?,?,?,00000002,004051BA,00403127,0040316E,?,00000000,?,?,?,00000000,?,00500689), ref: 00405192

Part of subcall function 00404FF4: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004050A5,?,?,?,00000002,004051BA,00403127,0040316E,?,00000000), ref: 0040502D
Part of subcall function 00404FF4: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004050A5,?,?,?,00000002,004051BA,00403127,0040316E,?), ref: 00405033
Part of subcall function 00404FF4: GetStdHandle.KERNEL32(000000F5,00405080,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004050A5), ref: 00405048
Part of subcall function 00404FF4: WriteFile.KERNEL32(00000000,000000F5,00405080,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004050A5), ref: 0040504E

Strings

PpP, xrefs: 0040508D

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: PpP
API String ID: 3490077880-3618234272
Opcode ID: 8b4ec287fa027d5ff3c1d182a5aac4f92a1386f0c0ad6db32dfffde6dcebc5ea
Instruction ID: 326c97155536ff9b2e35349fd2a04dcd90623b295c6773b27b5bdec8d43b2983
Opcode Fuzzy Hash: 8b4ec287fa027d5ff3c1d182a5aac4f92a1386f0c0ad6db32dfffde6dcebc5ea
Instruction Fuzzy Hash: 67317A70A04B058BDB30AB7A988871F7AE4EB54314F15053FE546AB3D2D7BC9884CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405080, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,?,00000002,004051BA,00403127,0040316E,?,00000000,?,?,?,00000000,?,00500689,00000000), ref: 004050B5
FreeLibrary.KERNEL32(00400000,?,?,?,00000002,004051BA,00403127,0040316E,?,00000000,?,?,?,00000000,?,00500689), ref: 00405156
ExitProcess.KERNEL32(00000000,?,?,?,00000002,004051BA,00403127,0040316E,?,00000000,?,?,?,00000000,?,00500689), ref: 00405192

Part of subcall function 00404FF4: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004050A5,?,?,?,00000002,004051BA,00403127,0040316E,?,00000000), ref: 0040502D
Part of subcall function 00404FF4: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004050A5,?,?,?,00000002,004051BA,00403127,0040316E,?), ref: 00405033
Part of subcall function 00404FF4: GetStdHandle.KERNEL32(000000F5,00405080,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004050A5), ref: 00405048
Part of subcall function 00404FF4: WriteFile.KERNEL32(00000000,000000F5,00405080,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004050A5), ref: 0040504E

Strings

PpP, xrefs: 0040508D

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: PpP
API String ID: 3490077880-3618234272
Opcode ID: 4852574034ef7f4b1806277fbcaac3175f1f331923d0f879cfd5c75ae8b15987
Instruction ID: b18b6657ac8b64f02c61dbedec7670c985be1cd86739f4a5ab8f29c96c150fc5
Opcode Fuzzy Hash: 4852574034ef7f4b1806277fbcaac3175f1f331923d0f879cfd5c75ae8b15987
Instruction Fuzzy Hash: EC314A70A04B058BDB31AB7A948831B7AE4AB54314F15053FE546AB3D2D7BCA884CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004AD388, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,00000000,?,?,?,p5K,00000000,T5K,?,000000EC,00000000,004AD402,?,?,000000EC,00000001), ref: 004AD3DC
GetLastError.KERNEL32(00000000,00000000,?,?,?,p5K,00000000,T5K,?,000000EC,00000000,004AD402,?,?,000000EC,00000001), ref: 004AD3E4

Strings

p5K, xrefs: 004AD3CA, 004AD3CD
T5K, xrefs: 004AD3C2, 004AD3C5

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateErrorLastProcess
String ID: T5K$p5K
API String ID: 2919029540-167569163
Opcode ID: e5857294318a67993d9e0b284e8a269a82839010d14840b5d241286c2a207c5a
Instruction ID: 9f68fece474892b3899a659e9853b08a014afd7a3271b1ba78e325360b9152a4
Opcode Fuzzy Hash: e5857294318a67993d9e0b284e8a269a82839010d14840b5d241286c2a207c5a
Instruction Fuzzy Hash: 66113972A04208AFDB50DFA9DC81DDFB7ECEB8E310B514566F909D3641D638ED118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004AA154, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 004AA124: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004AA13C

LoadLibraryW.KERNEL32(00000000,00000000,004AA21C,?,00000000,00000000,00000000,00000000), ref: 004AA1AB
LoadLibraryW.KERNEL32(00000000,00000000,00000000,004AA21C,?,00000000,00000000,00000000,00000000), ref: 004AA1F1

Strings

RICHED20.DLL, xrefs: 004AA1DE
MSFTEDIT.DLL, xrefs: 004AA198

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$DirectorySystem
String ID: MSFTEDIT.DLL$RICHED20.DLL
API String ID: 2630572097-3133735514
Opcode ID: 5d8eec8f67e9781dd6c99f7d3cda0e133ec028ad4011581b0f04bb39ff513c88
Instruction ID: 7c12972dfc463b3220d1a8718c6e27a40a75ad72bf63ee768228bde957cd3b10
Opcode Fuzzy Hash: 5d8eec8f67e9781dd6c99f7d3cda0e133ec028ad4011581b0f04bb39ff513c88
Instruction Fuzzy Hash: E2118E70900249AFDF00FB61DC42AAE77B8FB16308F51857BA400A7252E77C6929DF1A

Uniqueness

Uniqueness Score: -1.00%

Function 004B08EC, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FDB8: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,0048048E,?,00000000,?,0048042E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0048048E), ref: 0047FDD4

RegCloseKey.ADVAPI32(?,004B0957,?,00000001,00000000), ref: 004B094A

Strings

PendingFileRenameOperations2, xrefs: 004B092B
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 004B08F8
PendingFileRenameOperations, xrefs: 004B091C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 58986ab286d26830ac093941222a08c79d51475d24b02210f60cfa8b25d4c649
Instruction ID: 66933c4a8a258c41fd3788527b36b431d194454fda001adecb7db977d2005a08
Opcode Fuzzy Hash: 58986ab286d26830ac093941222a08c79d51475d24b02210f60cfa8b25d4c649
Instruction Fuzzy Hash: DEF0C2B1204308AFF70496669C13E9BB79CD744711F60847AF504D2682DA78FE10863C

Uniqueness

Uniqueness Score: -1.00%

Function 0047FDE0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32(?,00000000,?,00000000,0047FFD3,00000000,0047FFEB,?,?,?), ref: 0047FDEC
GetModuleHandleW.KERNEL32(advapi32.dll,RegDeleteKeyExW,?,00000000,0047FFD3,00000000,0047FFEB,?,?,?), ref: 0047FE07

Strings

advapi32.dll, xrefs: 0047FE02
RegDeleteKeyExW, xrefs: 0047FDFD

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteHandleModule
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 3550747403-4033151799
Opcode ID: e03c49d59a8e0b7274e787696d68dbc17562aa9ea509ee92a52a4ea27964f758
Instruction ID: 83983490c931339ab91321a1cf6068cbfa8726febe64567cb860cadc666f1b62
Opcode Fuzzy Hash: e03c49d59a8e0b7274e787696d68dbc17562aa9ea509ee92a52a4ea27964f758
Instruction Fuzzy Hash: D9E09B70501310AEE72427696C4DFDB1A588F15715F146437F00DA92E3C6FC0C8DD65C

Uniqueness

Uniqueness Score: -1.00%

Function 004608E0, Relevance: 6.4, APIs: 4, Instructions: 359COMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00460D50

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Capture
String ID:
API String ID: 1145282425-0
Opcode ID: 216c6e485177341ca509e42ca4ff117f3ad535cad855532a532cf4e8d4c12152
Instruction ID: 8ab871241581dc8c50fa229fb2fe2f3f0e0c5fa89ff07ccd0aee80e13c60ee39
Opcode Fuzzy Hash: 216c6e485177341ca509e42ca4ff117f3ad535cad855532a532cf4e8d4c12152
Instruction Fuzzy Hash: 6AE13E70A00204DFDB14DFA9C589BAFB7F1EF44314F2441A6E404AB796E738AE45DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0045E518, Relevance: 6.3, APIs: 4, Instructions: 308COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000000,00000000), ref: 0045E697
MulDiv.KERNEL32(?,?,?), ref: 0045E6D2

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9785093a6d54008bfd266b241f05734eb2854a51a37872944ba1ed9422af0dc1
Instruction ID: f5a44b4ecf8273a7912cda93128946dc8fefe324ca498f52069e8d45b892272c
Opcode Fuzzy Hash: 9785093a6d54008bfd266b241f05734eb2854a51a37872944ba1ed9422af0dc1
Instruction Fuzzy Hash: 37D17B70A00605DFCB15CF69C584AAEBBF2BF48301F208A5AE856DB756D734EE05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 004E35F0, Relevance: 6.1, APIs: 4, Instructions: 142fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(000000FF,?,?,00000000,?,00000000,004E37CE,?,00000000,00000000,?,?,004E4B58,?,?,00000000), ref: 004E369C
FindClose.KERNEL32(000000FF,000000FF,?,?,00000000,?,00000000,004E37CE,?,00000000,00000000,?,?,004E4B58,?,?), ref: 004E36A9
FindNextFileW.KERNEL32(000000FF,?,00000000,004E37A1,?,004E37EC,00000000,?,?,00000000,?,00000000,004E37CE,?,00000000,00000000), ref: 004E377D
FindClose.KERNEL32(000000FF,004E37A8,004E37A1,?,004E37EC,00000000,?,?,00000000,?,00000000,004E37CE,?,00000000,00000000), ref: 004E379B

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 4d4266f064d900bc22378ecec5b87c8551178d55f1494f51799dc6c8f4c0977c
Instruction ID: 27b6a5451055e0a9f26508bfbea81d063eb34710f3a0a64da1c58f2493d9d6dc
Opcode Fuzzy Hash: 4d4266f064d900bc22378ecec5b87c8551178d55f1494f51799dc6c8f4c0977c
Instruction Fuzzy Hash: 4451A1B4A04249AFDF21DF66C849ADEB7B8EB49305F1045AAF858A3341D6389F41CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00479464, Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32(00000000,?,?,00000000,?,004697B2,00000000,00000000,?,00000000,?,00000000,00469843), ref: 004794A9
GetDC.USER32(00000000,00000000,?,?,00000000,?,004697B2,00000000,00000000,?,00000000,?,00000000,00469843), ref: 004794FE
GetDeviceCaps.GDI32(00000000,0000005A,00000000,00000000,?,?,00000000,?,004697B2,00000000,00000000,?,00000000,?,00000000,00469843), ref: 00479508
ReleaseDC.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,?,?,00000000,?,004697B2,00000000,00000000,?,00000000,?), ref: 00479513

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsDeviceKeyboardLayoutRelease
String ID:
API String ID: 3331096196-0
Opcode ID: 527581b53eabb525a5d842b93fd69fb7ae28a2b9ce12bae3b9eb28f0e28bcbe4
Instruction ID: 2c003ed1b59c606b69cda5a92803f439eb5052984457165d01e451538574897c
Opcode Fuzzy Hash: 527581b53eabb525a5d842b93fd69fb7ae28a2b9ce12bae3b9eb28f0e28bcbe4
Instruction Fuzzy Hash: 66410CB06412409FD750EF29D9C6B547BE0AF45318F85C1BAE9089F363D77AAC08CB18

Uniqueness

Uniqueness Score: -1.00%

Function 004431F0, Relevance: 6.1, APIs: 4, Instructions: 81windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000BB,?,00000000,00000000,004432D5), ref: 0044322C
SendMessageW.USER32(00000000,000000BB,?,00000000,00000000,000000BB,?,00000000,00000000,004432D5), ref: 0044325B
SendMessageW.USER32(00000000,000000C1,00000000,00000000,00000000,000000BB,?,00000000,00000000,000000BB,?,00000000,00000000,004432D5), ref: 00443277
SendMessageW.USER32(00000000,000000B1,00000000,00000000,00000000,000000C1,00000000,00000000,00000000,000000BB,?,00000000,00000000,000000BB,?,00000000), ref: 004432A2

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4238deefb9a98b9dc4827ecf0430bac290cb5ca36e7226564620af4d3aadda96
Instruction ID: 33a4a35158f50e7952216364664e6d19fef1d668f52b60ed97f9a09f41273af6
Opcode Fuzzy Hash: 4238deefb9a98b9dc4827ecf0430bac290cb5ca36e7226564620af4d3aadda96
Instruction Fuzzy Hash: AE21A1707007457EE710EEA6CC82F5B76ACAB44B05F6044BE7505E76C2DAB8DE008629

Uniqueness

Uniqueness Score: -1.00%

Function 00478990, Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000EC,?,?,00475D03), ref: 004789C4
SetWindowLongW.USER32(00000000,000000EC,00000000,00000000,000000EC,?,?,00475D03), ref: 004789F6
SetWindowLongW.USER32(00000000,000000EC,00000000,00000000,000000EC,?,?,00475D03), ref: 00478A4D
RedrawWindow.USER32(00000000,00000000,00000000,00000485,00000000,000000EC,00000000,00000000,000000EC,?,?,00475D03), ref: 00478A63

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$Redraw
String ID:
API String ID: 533842358-0
Opcode ID: b582c38d4794c8e32411b4bc278de6a0b97ddac01870cd1ec1ceb94ee44b9896
Instruction ID: 66081f0949e1bf9c2e75eb3d8f3a88653f8c8e57273393afd5c3ba874abd36a7
Opcode Fuzzy Hash: b582c38d4794c8e32411b4bc278de6a0b97ddac01870cd1ec1ceb94ee44b9896
Instruction Fuzzy Hash: 3F119BA1A443D02ADB517F754C89B9A2A4C0F11317F14057BB985EA1D7CA3CCE44D769

Uniqueness

Uniqueness Score: -1.00%

Function 0042BE68, Relevance: 6.1, APIs: 4, Instructions: 59registryCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00400000,0042BE4C,?,00000000), ref: 0042BE89
UnregisterClassW.USER32(0042BE4C,00400000,00400000,0042BE4C,?,00000000), ref: 0042BEB2
RegisterClassW.USER32(00503ED0,00400000,0042BE4C,?,00000000), ref: 0042BEBC
SetWindowLongW.USER32(00000000,000000FC,00000000,00000000,00000B06,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000000,80000000,00503ED0,00400000), ref: 0042BF07

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 6277946a813458cfec179e7d6f1ea1b80ba9bd1a74af736911b31c0c4e72595e
Instruction ID: 6f9ff9bfbe11de6e0486b74ddb1a689169ce474f98adb0683e705fafa2381aa4
Opcode Fuzzy Hash: 6277946a813458cfec179e7d6f1ea1b80ba9bd1a74af736911b31c0c4e72595e
Instruction Fuzzy Hash: 82013C717041046ACB10EB99EC42F9F779DE718318F504626FA04E73E2C77A9D189799

Uniqueness

Uniqueness Score: -1.00%

Function 0047AF5C, Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

EnumWindows.USER32(Function_0007AEA8), ref: 0047AF89
GetWindow.USER32(?,00000003,Function_0007AEA8), ref: 0047AFA1
GetWindowLongW.USER32(00000000,000000EC,?,00000003,Function_0007AEA8), ref: 0047AFAE
SetWindowPos.USER32(00000000,000000EC,00000000,00000000,00000000,00000000,00000213,00000000,000000EC,?,00000003,Function_0007AEA8), ref: 0047AFED

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: caeaef294ebad233672d420f854faf0511b45cf9672cdacc14cc94ae4c3418f7
Instruction ID: 6f16d58c38ac77443b4c8f16d3882f5b4522f34a8fdb18cf32ce2e4e8a89bdcd
Opcode Fuzzy Hash: caeaef294ebad233672d420f854faf0511b45cf9672cdacc14cc94ae4c3418f7
Instruction Fuzzy Hash: FC1186716442109BEB109A2CCC85F9A73E4AB44725F14827AFD9CEF2D2C7789C50C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 00402F1C, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00402FFC,00408E5C,00000000,00408E7E), ref: 00402F3A
VirtualFree.KERNEL32(00509AD0,00000000,00008000,?,00000000,00008000,?,?,?,?,00402FFC,00408E5C,00000000,00408E7E), ref: 00402F97

Strings

l0P, xrefs: 00402F4A
,zP, xrefs: 00402F20

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeVirtual
String ID: ,zP$l0P
API String ID: 1263568516-3714777296
Opcode ID: 9e1adc23513262e68effe7ada2e3d04e5e4e0fe02bb7eba4c5fba73f5ed40486
Instruction ID: 6279c519e14a5305296dde13ccf9ebc9d985b9e794f25398c124821f3531ef09
Opcode Fuzzy Hash: 9e1adc23513262e68effe7ada2e3d04e5e4e0fe02bb7eba4c5fba73f5ed40486
Instruction Fuzzy Hash: 591165717016019BD7148F059984B1ABAE5E784750F15C07EF209AF3D6D6B8EC019768

Uniqueness

Uniqueness Score: -1.00%

Function 004AFD14, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(00000001,00000032,?,?,?,00000001,?,?,004B0142,?,0000003C,00000000,004B0158,?,?,?), ref: 004AFD40
MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF,?,?,?,00000001,?,?,004B0142,?,0000003C,00000000,004B0158), ref: 004AFD62
GetExitCodeProcess.KERNEL32(00000001,?,00000000,004AFD99,?,?,?,00000001,?,?,004B0142,?,0000003C,00000000,004B0158), ref: 004AFD73
CloseHandle.KERNEL32(00000001,004AFDA0,004AFD99,?,?,?,00000001,?,?,004B0142,?,0000003C,00000000,004B0158), ref: 004AFD93

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: c2c7523fc3b7d7fa21cc23171f0849ab5e34e6ab2998cbdf75ced64a2e4fa919
Instruction ID: f6845b11aca24efc4b3869ffc2e65a1583259b886a0e04f2f0f5bcd82376b759
Opcode Fuzzy Hash: c2c7523fc3b7d7fa21cc23171f0849ab5e34e6ab2998cbdf75ced64a2e4fa919
Instruction Fuzzy Hash: 03012870A402047EEB2297E68C06F6B7BACDF5A720F600537F504D72D2D6BC9D00C6A9

Uniqueness

Uniqueness Score: -1.00%

Function 004E0000, Relevance: 6.0, APIs: 4, Instructions: 34sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004E0020
GetLastError.KERNEL32 ref: 004E002A
GetTickCount.KERNEL32 ref: 004E0034
Sleep.KERNEL32(00000032), ref: 004E0044

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 66cb2da5fb3d686166b4961908d95fb1adc75bf8bf0f26d2e18c571cc6a30f71
Instruction ID: b2cd03c0995200a52b1dbdfcd572ba0329651e8d83cbad51d48a1a90dd64b34f
Opcode Fuzzy Hash: 66cb2da5fb3d686166b4961908d95fb1adc75bf8bf0f26d2e18c571cc6a30f71
Instruction Fuzzy Hash: 85E02BB22092C114C731357F398267F5584CF8231AF29093FF0D8D2153C85D4C85417E

Uniqueness

Uniqueness Score: -1.00%

Function 004B84FC, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 004AAFE0: SetEndOfFile.KERNEL32(?,?,004B85D3,00000000,004B8765,?,00000000,00000002,00000002), ref: 004AAFE7

FlushFileBuffers.KERNEL32(?,00000080), ref: 004B8731

Strings

EndOffset range exceeded, xrefs: 004B865F
NumRecs range exceeded, xrefs: 004B8628

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 95ef25ed12b73005bcdb1cbcf38d0c04b607b4889d94f5d4c803180d8a8edb89
Instruction ID: ab0f0c2dd3242b746526c1d23b7b047fc02cd1c50c9591f4f688e4a1bcfa8bd5
Opcode Fuzzy Hash: 95ef25ed12b73005bcdb1cbcf38d0c04b607b4889d94f5d4c803180d8a8edb89
Instruction Fuzzy Hash: 5B615234A002948FCB25DF25CC91ADAB7B5FF49304F1444DAE9889B391DA78AEC5CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004AE5E0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,?,00000000,004AE6D5,?,00000000,0050C17C,00000003,00000000,00000000,?,004DFE3B,00000000,004DFF66), ref: 004AE628
GetLastError.KERNEL32(00000000,00000000,?,00000000,004AE6D5,?,00000000,0050C17C,00000003,00000000,00000000,?,004DFE3B,00000000,004DFF66), ref: 004AE631

Strings

.tmp, xrefs: 004AE611

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 0f8a613f289b8be68711ff10d758265e63058dc167558e2d91c3b255f6406cd0
Instruction ID: adf5e30c7f59dfe5aba830ab051b3105d15c4b731b1feb6e6b65d8d709f8ccd3
Opcode Fuzzy Hash: 0f8a613f289b8be68711ff10d758265e63058dc167558e2d91c3b255f6406cd0
Instruction Fuzzy Hash: C0215875A001089FDB00EBA5C892ADEB3B9EB59308F50457BF911B7381DA789E058B69

Uniqueness

Uniqueness Score: -1.00%

Function 0042DB24, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(?), ref: 0042DB86

Part of subcall function 0042DA04: GetProcAddress.KERNEL32(77400000,00000000,00000000,0042DAE6), ref: 0042DAA0

GetSystemMetrics.USER32(?), ref: 0042DB4C

Strings

GetSystemMetrics, xrefs: 0042DB34

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem$AddressProc
String ID: GetSystemMetrics
API String ID: 1792783759-96882338
Opcode ID: 5a2d9467619adf4c9c0a59c4e3d1bca45baf3b029750afce2be017329c30f3e4
Instruction ID: 81924381e501da5388a4d909a6d80ca569f30661e9ffd41aa1eabdd9a780252a
Opcode Fuzzy Hash: 5a2d9467619adf4c9c0a59c4e3d1bca45baf3b029750afce2be017329c30f3e4
Instruction Fuzzy Hash: 9FF0CD71F141A44AEB104A34FCE5B673D1AA752370FE24B33E221862D2C2BDB848A24C

Uniqueness

Uniqueness Score: -1.00%

Function 00479890, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00,?,?,?,004708FC,004794A7,?,?,00000000,?,004697B2,00000000,00000000,?,00000000), ref: 0047989D
LoadCursorW.USER32(00000000,00000000,00000000,00007F00,?,?,?,004708FC,004794A7,?,?,00000000,?,004697B2,00000000,00000000), ref: 004798CF

Strings

8MP, xrefs: 004798AD

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CursorLoad
String ID: 8MP
API String ID: 3238433803-4219800966
Opcode ID: 950adc91044c3f391694f336ac1fe6a76546a8536e358059c3dc0edb66a49631
Instruction ID: 9bd0b1b73a95ab5c95111bda4effe15472ba51e55bc4dd7995c08858671ad0eb
Opcode Fuzzy Hash: 950adc91044c3f391694f336ac1fe6a76546a8536e358059c3dc0edb66a49631
Instruction Fuzzy Hash: 0EF08211B116041ADA20753E9CC0AAA73949FD3334F25437BF96ED73D2C6291C4A915A

Uniqueness

Uniqueness Score: -1.00%

Function 00439580, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(DWMAPI.DLL,?,?,?,00478C65), ref: 004395AA

Strings

DwmExtendFrameIntoClientArea, xrefs: 004395C2
DWMAPI.DLL, xrefs: 004395A5

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad
String ID: DWMAPI.DLL$DwmExtendFrameIntoClientArea
API String ID: 1029625771-2956373744
Opcode ID: 47fc47497989b6d7c472d5b4637e96d6eb8fe377f1c88ad55f8f4032707cb5ac
Instruction ID: 29d7637e4d2283d42abcfd41717a00e206b2c3c72b148d4e0d7ad269df35576e
Opcode Fuzzy Hash: 47fc47497989b6d7c472d5b4637e96d6eb8fe377f1c88ad55f8f4032707cb5ac
Instruction Fuzzy Hash: 6FF012B2601210EFD721AB6DAC5CB5F3EA4976F315F10566BA909D22A1D2BD0CCCD614

Uniqueness

Uniqueness Score: -1.00%

Function 004DF734, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,004DFAB3,00000000,004DFACE,?,00000005,00000000,00000000,?,004FEA10), ref: 004DF796

Strings

RegisteredOrganization, xrefs: 004DF785
RegisteredOwner, xrefs: 004DF773

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 743470bbcdb0687bb9c1af046c749980bc476c46d69a27787d849bdf25ad0dae
Instruction ID: 9ed6b90036b2198aed50c860d264af769602323584f9052628199994feb00913
Opcode Fuzzy Hash: 743470bbcdb0687bb9c1af046c749980bc476c46d69a27787d849bdf25ad0dae
Instruction Fuzzy Hash: B2F0B435300148AFE720D7A59CA6BDF77A9B741344F20403BF9069B381E6789E09DB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042E958, Relevance: 4.6, APIs: 3, Instructions: 144registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,0042EB09), ref: 0042E9D1
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,00000000,0042EB09), ref: 0042EA41
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?), ref: 0042EAAC

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 057ae331dc0bc26a5a9d987f2dc1917bfa7a782ac724f1ba2a3b7771a2c744cf
Instruction ID: 59eb417c563a6279f20b857974017f72d6fe6cd0f8fd2b7a65c805dc29754b4d
Opcode Fuzzy Hash: 057ae331dc0bc26a5a9d987f2dc1917bfa7a782ac724f1ba2a3b7771a2c744cf
Instruction Fuzzy Hash: 3041E331F00218ABDB11DBA6D842B9EB7FAAF44308F55447EF445E3282C779AF059748

Uniqueness

Uniqueness Score: -1.00%

Function 004125AC, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,00412682), ref: 004125EE
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,00412665,?,00000000,?,00000000,00412682), ref: 00412623
VerQueryValueW.VERSION(?,00412694,?,?,00000000,?,00000000,?,00000000,00412665,?,00000000,?,00000000,00412682), ref: 0041263D

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: 98baa7c980387096999055e826b105b682116fad401780b38f368821b356b856
Instruction ID: 9b2b4ea1bf60b56f114535951958a67cb16ac7b149ee08c68e447b19616cc110
Opcode Fuzzy Hash: 98baa7c980387096999055e826b105b682116fad401780b38f368821b356b856
Instruction Fuzzy Hash: 5B215371A10649AFDB00EFA5CD92CAEB7FCEB48704B524476B400E36D1E7789E14C728

Uniqueness

Uniqueness Score: -1.00%

Function 004AD044, Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,?,?,?), ref: 004AD064
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,004AD0DF,?,00000000,?,?,?,?), ref: 004AD091
VerQueryValueW.VERSION(?,004AD108,?,?,00000000,?,00000000,?,00000000,004AD0DF,?,00000000,?,?,?,?), ref: 004AD0AB

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: 4cc2fe8d6b0d2cf388c54127a7727e04da8e77eed0b3cf134ab9c6c347f951b7
Instruction ID: abc5115832997836082f85ecf18093d4add992edd05f68ec24656801c81bd876
Opcode Fuzzy Hash: 4cc2fe8d6b0d2cf388c54127a7727e04da8e77eed0b3cf134ab9c6c347f951b7
Instruction Fuzzy Hash: C121D431A04148AFDB01DAA9CC419BFB7FCEB4A704F5540BAF804E3781D6399E05C769

Uniqueness

Uniqueness Score: -1.00%

Function 004A4F30, Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000,?,00000000,00000000,004A5031,?,?), ref: 004A4FA5
SelectObject.GDI32(?,00000000,00000000,004A5001,?,00000000,?,00000000,00000000,004A5031,?,?), ref: 004A4FC8
ReleaseDC.USER32(00000000,?,004A5008,00000000,004A5001,?,00000000,?,00000000,00000000,004A5031,?,?), ref: 004A4FFB

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectReleaseSelect
String ID:
API String ID: 1831053106-0
Opcode ID: 3963367fd60c4439979eb726035ae58074f3192c1a1b4b60fce15dc2690315b2
Instruction ID: 214b35b97507ae1df1a54bc5d9a60bcad0a1f01e76162f43015524e55f31187f
Opcode Fuzzy Hash: 3963367fd60c4439979eb726035ae58074f3192c1a1b4b60fce15dc2690315b2
Instruction Fuzzy Hash: 5F21A770E04208AFDB14DFA5C982B5EB7F9EB99304F51807AF400A7282D7B89E40C658

Uniqueness

Uniqueness Score: -1.00%

Function 004017F8, Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00401E07,?,00401ADA), ref: 0040180E

Strings

,zP, xrefs: 0040181F
,zP, xrefs: 00401817, 00401825

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ,zP$,zP
API String ID: 4275171209-2808556191
Opcode ID: 656ed10eb22c6abfee8635f179b815ee339fc6f71f3db4fb911ca373b2fcb71f
Instruction ID: c6cf400e033ffa62d3e1f9368c4799eba0ff23d575c79a64c397007cadb58ba6
Opcode Fuzzy Hash: 656ed10eb22c6abfee8635f179b815ee339fc6f71f3db4fb911ca373b2fcb71f
Instruction Fuzzy Hash: 4DF049B1F153004BDB159F799D4130A7AD2B78D308F10817DEA09DB7A9E77595069B00

Uniqueness

Uniqueness Score: -1.00%

Function 00470C44, Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00470C54
IsWindowEnabled.USER32(?,?), ref: 00470C5E
EnableWindow.USER32(?,00000000,?,?), ref: 00470C84

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: 4fb512214e139f42b3519553ff4c35a9537f3d5e196d8c5165b925a57d24ceb5
Instruction ID: aa2534058fad014fd045f5252136a0cd072f421d674c4af11c5d53a6d97dbeda
Opcode Fuzzy Hash: 4fb512214e139f42b3519553ff4c35a9537f3d5e196d8c5165b925a57d24ceb5
Instruction Fuzzy Hash: 0FE0E5B01062009EE714AF36DD81A1A779CBB54314F54826AA948972D3DA39EC0456AC

Uniqueness

Uniqueness Score: -1.00%

Function 004E1998, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 148windowCOMMON

Download Yara Rule

APIs

SendNotifyMessageW.USER32(000B0076,00000496,00002711,-00000001,?,?,00000001,00000000,004E1C68,?,-0000001A,004E3F22,-00000010,?,00000004,0000001C), ref: 004E1BC0

Strings

MS PGothic, xrefs: 004E1A14, 004E1A27

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageNotifySend
String ID: MS PGothic
API String ID: 3556456075-3532686627
Opcode ID: 0074b67dbdf36d9008321daafe5bbd107f06861fca42d1db3526fabbfd6417b4
Instruction ID: c29f0009e0aae56d2e5ede1e1951730f92d2f4651538b35d0fc29d9cfe14bd1d
Opcode Fuzzy Hash: 0074b67dbdf36d9008321daafe5bbd107f06861fca42d1db3526fabbfd6417b4
Instruction Fuzzy Hash: 495194303001408FC700EF2AD885A5F77A6EB55345F6486B7A8449B3B6DA38EC4ADF9D

Uniqueness

Uniqueness Score: -1.00%

Function 004323A8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetTextExtentPoint32W.GDI32(?,00000000,\$C,?,00000000,00432435,?,?,?,?,?,?,0043245C), ref: 0043241A

Strings

\$C, xrefs: 004323B6, 004323E3, 0043240D, 0043242C, 004323F5, 004323F8, 0043240C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ExtentPoint32Text
String ID: \$C
API String ID: 223599850-2228944714
Opcode ID: 1c48e5f102ca0cd734aa6fbdb24ed5944197a9a369d8079589df42c257f63b32
Instruction ID: ef2dcd0178e34016aa7600b48af84fc301d83ac5f681d29213068d71d6aed5a9
Opcode Fuzzy Hash: 1c48e5f102ca0cd734aa6fbdb24ed5944197a9a369d8079589df42c257f63b32
Instruction Fuzzy Hash: 4311AD70600654AFCB11DF7ADA4294BB7FCEB4D704761807AF404E3252E7B8EE00CA68

Uniqueness

Uniqueness Score: -1.00%

Function 004E0054, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32(004E0000,00000000,00000000,00000001,00000001,00000000,004E00E6,?,00000000,?,004FFB59,00000000,004FFB63), ref: 004E009C

Strings

Failed to remove temporary directory: , xrefs: 004E00BE

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: 5073db53d886c54505b17a68cb92e824eb4312af4c455160ed439edf1f25904b
Instruction ID: c9c13672678a2043637417fb1f8cd2c9ece185abb54a25e22bd0d5aba4305c30
Opcode Fuzzy Hash: 5073db53d886c54505b17a68cb92e824eb4312af4c455160ed439edf1f25904b
Instruction Fuzzy Hash: 7A01D4716103806ADB10EB72ED53F5A37E4DB45705F614837F400A72D2DAFC9980E52C

Uniqueness

Uniqueness Score: -1.00%

Function 0040A124, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,TWindowDisabler-Window,00000000,00481636,?,?,000000EC,00000001,00000000,?,004B36C3,?,00480FE0,000000EC,00000001,0048165C), ref: 0040A163

Strings

TWindowDisabler-Window, xrefs: 0040A161

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateWindow
String ID: TWindowDisabler-Window
API String ID: 716092398-1824977358
Opcode ID: 525154ca484f26252d46408543c51958e5444091af8ab4db31887610460425bf
Instruction ID: f482a91b61e37fa524220f56b4221b3e08f072a29bcffce70241aac4ef41fcfc
Opcode Fuzzy Hash: 525154ca484f26252d46408543c51958e5444091af8ab4db31887610460425bf
Instruction Fuzzy Hash: 9CF097B2600118BF8B40DE9DDC81DDF77ECEB4D265B054129FA0CE7201D634ED1087A4

Uniqueness

Uniqueness Score: -1.00%

Function 004DF680, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FDB8: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,0048048E,?,00000000,?,0048042E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0048048E), ref: 0047FDD4

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,004DF8C9,00000000,004DFACE,?,00000005,00000000,00000000), ref: 004DF6C7

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004DF695

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: c304f704bba9898537437c7894bab02ef66d703c1a8ac85027a8773c13283d7d
Instruction ID: 7c9a22b7b779153fad846c406f22883dc1d612c81379a15e204268f425cf8541
Opcode Fuzzy Hash: c304f704bba9898537437c7894bab02ef66d703c1a8ac85027a8773c13283d7d
Instruction Fuzzy Hash: FBF089217042086BE714A56A5C52BAB529D9B84758F10803FBA05D7351D9B9DD0643A9

Uniqueness

Uniqueness Score: -1.00%

Function 0042EB2C, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,MS Shell Dlg 2,?,MS Shell Dlg 2,?,0042EB90), ref: 0042EB5E

Strings

MS Shell Dlg 2, xrefs: 0042EB2D, 0042EB2F

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryValue
String ID: MS Shell Dlg 2
API String ID: 3660427363-3198668166
Opcode ID: 1d17029525d42380ecfd09458cdde964654e6f99027025c473d9c5c0cb56fbd2
Instruction ID: 7ea64c19d020a4510c8e75c356f283d9df9fd59428ee1212c04517f937eb6afb
Opcode Fuzzy Hash: 1d17029525d42380ecfd09458cdde964654e6f99027025c473d9c5c0cb56fbd2
Instruction Fuzzy Hash: F5F030723092547BD704EA6EAC41FABB7DCDB88755F01803EBA48C7682DA34DD058379

Uniqueness

Uniqueness Score: -1.00%

Function 0047FDB8, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,0048048E,?,00000000,?,0048042E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0048048E), ref: 0047FDD4

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 0047FDD2

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Open
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 71445658-1109908249
Opcode ID: b48ad7420b95d8d34a0e48061ba61225ccc215f0b48d5e8e56374ebce42a6802
Instruction ID: a1ec3a79691332836ec49b9e1eee4ce454422b76237ee675e84e05a14892a423
Opcode Fuzzy Hash: b48ad7420b95d8d34a0e48061ba61225ccc215f0b48d5e8e56374ebce42a6802
Instruction Fuzzy Hash: A3D0927695022C7BDB109A99DC81DFB779D9B19360F40802AFD1897241D2B4AC518BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004AED78, Relevance: 3.2, APIs: 2, Instructions: 192fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(000000FF,?,00000000,004AEFA2,?,00000000,004AF016,?,?,?,004B793C,00000031,004B60FC,004B60F0,00000000,00000000), ref: 004AEF7E
FindClose.KERNEL32(000000FF,004AEFA9,004AEFA2,?,00000000,004AF016,?,?,?,004B793C,00000031,004B60FC,004B60F0,00000000,00000000,00000000), ref: 004AEF9C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: b49ceda837bfc3fe666ef916857fadab7d2edaaffdd054e4be707e49d24be674
Instruction ID: bba80ab8aa3097ec5b8c4869022a93741185df38488322947be39690d2240be8
Opcode Fuzzy Hash: b49ceda837bfc3fe666ef916857fadab7d2edaaffdd054e4be707e49d24be674
Instruction Fuzzy Hash: A8818130908288AFDF21DFA6C4457EEBBB5EF5A304F1441ABE854A7281C3389F45CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0047FE78, Relevance: 3.1, APIs: 2, Instructions: 127registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(004FF080,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0047FFBD,?,004FF080,00000008,00000000,00000000,0047FFEB), ref: 0047FF31
RegCloseKey.ADVAPI32(004FF080,0047FFC4,?,00000000,00000000,00000000,00000000,00000000,0047FFBD,?,004FF080,00000008,00000000,00000000,0047FFEB), ref: 0047FFB7

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEnum
String ID:
API String ID: 2818636725-0
Opcode ID: b8d667f2be08eb49ed9fe54ab4ed0345f2bd593f4ad89a079189f1cf5b91bfe5
Instruction ID: e246d4eb175af44e9837b1908badb439ce647714dda197ba056c3bf6fa9a2068
Opcode Fuzzy Hash: b8d667f2be08eb49ed9fe54ab4ed0345f2bd593f4ad89a079189f1cf5b91bfe5
Instruction Fuzzy Hash: D3415F31A042199FDB11DBA5C951BEFB7B9EB49300F11847BE909B3281DB789E04DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00425CF0, Relevance: 3.1, APIs: 2, Instructions: 126COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000400,00000000,00000000,?,00000000,?), ref: 00425D98
CompareStringW.KERNEL32(00000400,00000001,00000000,?,00000000,?), ref: 00425E26

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: dadd2027cba7b88b3f8211b0e705fe3076a9d025728b347521c53b5e4de03463
Instruction ID: 44fd24d8050b78ce79515a951bb6a280ed2067b2457b7e5afdadd34336348172
Opcode Fuzzy Hash: dadd2027cba7b88b3f8211b0e705fe3076a9d025728b347521c53b5e4de03463
Instruction Fuzzy Hash: 8F41B030B00A25ABDB21DF75D882BAF73E9EF44704F918076E900B7785D778EE418658

Uniqueness

Uniqueness Score: -1.00%

Function 0047FB94, Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000001,?,00000000,00000000,00000000,?,00000000,0047FCCC,?,004E1BF0,00000000,00000000), ref: 0047FBD0
RegQueryValueExW.ADVAPI32(00000001,?,00000000,00000000,00000000,70000000,00000001,?,00000000,00000000,00000000,?,00000000,0047FCCC,?,004E1BF0), ref: 0047FC40

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e59d20ed8b60a60dd00c3bff68c75c68057ab89acddd5b672866198bf395a289
Instruction ID: ee2c940bff7b7f9e9c96be843ba767dfd9961d013a6c30695946cc5cd13dd3f9
Opcode Fuzzy Hash: e59d20ed8b60a60dd00c3bff68c75c68057ab89acddd5b672866198bf395a289
Instruction Fuzzy Hash: 29411B7190021DEFDB12DB95C981AEFB3B8FB44704F51847AEC05B7280D738AE499B99

Uniqueness

Uniqueness Score: -1.00%

Function 0047C574, Relevance: 3.1, APIs: 2, Instructions: 102COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC,?,?), ref: 0047C650
SetWindowLongW.USER32(?,000000EC,00000000,?,000000EC,?,?), ref: 0047C65E

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 5f355f45ae63ff72bbce865a1c824943356e8d63b48b490c39f2f1cbead73dad
Instruction ID: da9f2732937f802a627c0859110f50c8366629f7fb4310bf4df6dd5ea14a5fee
Opcode Fuzzy Hash: 5f355f45ae63ff72bbce865a1c824943356e8d63b48b490c39f2f1cbead73dad
Instruction Fuzzy Hash: DA413D70A04204EFDB11DF69C980A99B7F5FB49314F2192FAE918A7392D739AE00DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00475D70, Relevance: 3.1, APIs: 2, Instructions: 83threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(Function_00075D2C,?), ref: 00475E8B
EnumThreadWindows.USER32(00000000,Function_00075D2C,?), ref: 00475E91

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 1f2fd2a5d4c5271d5ff0d5b3d320b36bf8f7cc51876c9b6fb55f57151096ae08
Instruction ID: c07769cd1853295c0f4ff285db38ec85382d460fb4baaddd5b28d8e8a48a224c
Opcode Fuzzy Hash: 1f2fd2a5d4c5271d5ff0d5b3d320b36bf8f7cc51876c9b6fb55f57151096ae08
Instruction Fuzzy Hash: 4B310C30A01548EFDB11DFA9C585B9EB7F4EF44304F6541EAA808AB362D778AF40DB44

Uniqueness

Uniqueness Score: -1.00%

Function 00448660, Relevance: 3.1, APIs: 2, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0045FA14: GetClassInfoW.USER32(?,?,?,?,?,?,?,00442BD3,00000000,00442BEB), ref: 0045FAE4
Part of subcall function 0045FA14: UnregisterClassW.USER32(?,?,?,?,?,?,?,?,?,00442BD3,00000000,00442BEB), ref: 0045FB0F
Part of subcall function 0045FA14: RegisterClassW.USER32(?,?,?,?,?,?,?,?,00442BD3,00000000,00442BEB), ref: 0045FB2E
Part of subcall function 0045FA14: GetWindowLongW.USER32(00000000,000000F0,?,?,?,?,00442BD3,00000000,00442BEB), ref: 0045FB6A
Part of subcall function 0045FA14: GetWindowLongW.USER32(00000000,000000F4,00000000,000000F0,?,?,?,?,00442BD3,00000000,00442BEB), ref: 0045FB7F
Part of subcall function 0045FA14: SetWindowLongW.USER32(00000000,000000F4,00000000,00000000,000000F4,00000000,000000F0,?,?,?,?,00442BD3,00000000,00442BEB), ref: 0045FB92

SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000014,?,?,?,004A6AD6,00000000,004A6AED), ref: 00448688
SendMessageW.USER32(00000000,00000192,00000001,00000000,00000000,00000000,?,?,?,?,00000014,?,?,?,004A6AD6,00000000), ref: 004486AC

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$ClassLong$InfoMessageRegisterSendUnregister
String ID:
API String ID: 3941102255-0
Opcode ID: 8e449025d6a5c196cd986766ee7a4f4ebf4a26c4578ae5bc2c429a5ae952f3bf
Instruction ID: 4825d63b129ded9773937ab501cb089a2d5cabc6245c6cdba31e3d382c4389ec
Opcode Fuzzy Hash: 8e449025d6a5c196cd986766ee7a4f4ebf4a26c4578ae5bc2c429a5ae952f3bf
Instruction Fuzzy Hash: 9A21FA303002409BEB40AE69C8C9B9A3399AF46319F1845BEBD19DF397DA79DC058B64

Uniqueness

Uniqueness Score: -1.00%

Function 00470C94, Relevance: 3.1, APIs: 2, Instructions: 52threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(00470C44,00000000,00000000,00470D08,?,00000000,00470D46,?,00480FE0,000000EC,00000001), ref: 00470CEB
EnumThreadWindows.USER32(00000000,00470C44,00000000,00000000,00470D08,?,00000000,00470D46,?,00480FE0,000000EC,00000001), ref: 00470CF1

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 8cdf55d881a0e11a8e7a6ccc22f5647523398b91c2e68df418a28545dc5177ea
Instruction ID: 11d6b562068e59812b1feb7d809ae66aa1932c5418d7bb640ada29916db5e4a0
Opcode Fuzzy Hash: 8cdf55d881a0e11a8e7a6ccc22f5647523398b91c2e68df418a28545dc5177ea
Instruction Fuzzy Hash: F11191B090A740EFE319CF75EC10A4A7BE8F759710F118476E908D3351EA745804DE58

Uniqueness

Uniqueness Score: -1.00%

Function 004AD824, Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000,00000000,004AD88C), ref: 004AD866
GetLastError.KERNEL32(00000000,00000000,00000000,004AD88C), ref: 004AD86E

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: 973e424eae58dcf9489d2998c26519204dbc0d8244da627bb97128a425c7384d
Instruction ID: 33f70a5d894deb5c115b628207e544fa9d6ebef97149c1aa84241faad4f5b680
Opcode Fuzzy Hash: 973e424eae58dcf9489d2998c26519204dbc0d8244da627bb97128a425c7384d
Instruction Fuzzy Hash: FD01D632E04304ABCB11EBBA9C0149EB7E8DB4A71475145BBF815E3A42EA3C9D008258

Uniqueness

Uniqueness Score: -1.00%

Function 004AD310, Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,004AD36F), ref: 004AD349
GetLastError.KERNEL32(00000000,00000000,00000000,004AD36F), ref: 004AD351

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 0c045006dfe49432e39ed8f948dc78b45114a513f1b0d4aece66e972c3e4b9b4
Instruction ID: e00044b1d1c06f58af9efd65056a749125f00fd0027e84656df68c178dd83aac
Opcode Fuzzy Hash: 0c045006dfe49432e39ed8f948dc78b45114a513f1b0d4aece66e972c3e4b9b4
Instruction Fuzzy Hash: 90F0C871E04608ABDF01DBB69C015DEB3E8EB0A714B5145B7FC15E3A81E6395E008799

Uniqueness

Uniqueness Score: -1.00%

Function 004AD4A8, Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,00000000,004AD505,?,?,?,?,?,?,?,?,?,?,004B64F0,00000000,004B6644), ref: 004AD4DF
GetLastError.KERNEL32(00000000,00000000,004AD505,?,?,?,?,?,?,?,?,?,?,004B64F0,00000000,004B6644), ref: 004AD4E7

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 1234670d306d4cc21dbb3961aa5fd43a64a9314fecf96b5fe406ecc7ecb75b03
Instruction ID: c529bc5c6c563f39c5673746528eeb8521437201fb79b1d6828c81cfc8c38368
Opcode Fuzzy Hash: 1234670d306d4cc21dbb3961aa5fd43a64a9314fecf96b5fe406ecc7ecb75b03
Instruction Fuzzy Hash: 76F06831E04208BFDB11DFB59C4149EB3E8DB4B71875145B7F805E3A41EA795E108698

Uniqueness

Uniqueness Score: -1.00%

Function 004AD9B4, Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(00000000,00000000,004ADA11,?,?), ref: 004AD9EB
GetLastError.KERNEL32(00000000,00000000,004ADA11,?,?), ref: 004AD9F3

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: e118536941ec7ce629824761a5fbb7e3c3471c27c40c494ba7aaa59367059e09
Instruction ID: a88503c00b236fa86c25db574d5d9dfac9e8793ecfc5b63154d8e1c83a3d2074
Opcode Fuzzy Hash: e118536941ec7ce629824761a5fbb7e3c3471c27c40c494ba7aaa59367059e09
Instruction Fuzzy Hash: 6FF0FC36E14308AFDB01DFB59C414DEB3E8DB4A71475145B7F806E3A42E63D9E008698

Uniqueness

Uniqueness Score: -1.00%

Function 00409620, Relevance: 3.0, APIs: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644
GetProcAddress.KERNEL32(?,00000000,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409666

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d61bc043881c8c6bfe79b771c95475ab84ff338248c778fc4aa88fc9623a2036
Instruction ID: c89d22e9b9c93429c76f39329f2b2da4a35d652da9e9d6d2370a618858152621
Opcode Fuzzy Hash: d61bc043881c8c6bfe79b771c95475ab84ff338248c778fc4aa88fc9623a2036
Instruction Fuzzy Hash: 76F09630304608BFD701DA65CC52E6F779CDB8D714F910877F800B72C2D6796E008968

Uniqueness

Uniqueness Score: -1.00%

Function 0040D67C, Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?), ref: 0040D69E
GetLastError.KERNEL32(?,?,?), ref: 0040D6AC

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: db3fe33a00b6c46106f8b88f388a387eff11cb957e8100647f87652cf69980f2
Instruction ID: c472ddcc8d0cf22ae0bc6af7303cfb3ab6633d0263c2e5d846b0ad1e356bca39
Opcode Fuzzy Hash: db3fe33a00b6c46106f8b88f388a387eff11cb957e8100647f87652cf69980f2
Instruction Fuzzy Hash: D2F0BD76905218AFDB10DEA998818DEB7BCEE08230F20426AA964E33C1E6319F40DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00413CA8, Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000,?), ref: 00413CB2
LoadLibraryW.KERNEL32(00000000,00000000,00413CFC,?,00000000,00413D1A,?,00008000,?), ref: 00413CE1

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 7ef4b226449f4336f1db3ab389b5f025d1b7ddcb07c4e4a365eef599a9ad8b29
Instruction ID: 9af8a3bf650a19148b04a2cbed28409138188e1e95c91408170e766d10abea8e
Opcode Fuzzy Hash: 7ef4b226449f4336f1db3ab389b5f025d1b7ddcb07c4e4a365eef599a9ad8b29
Instruction Fuzzy Hash: 67F0A771A14744BFDF019F769C5286BBBFCE70DB0475388B6F801A2A92E63C4D10C668

Uniqueness

Uniqueness Score: -1.00%

Function 0047BFC0, Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000,00000000,?,004FF846,00000000,004FFACA,?,?,00000000,?), ref: 0047BFF0
SetWindowTextW.USER32(?,00000000,00000000,?,004FF846,00000000,004FFACA,?,?,00000000,?), ref: 0047C006

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: a96f2db92880f3934b0b19eea0be8f60c2c27bdad88fd431c7dcc4505a68df2e
Instruction ID: cd19e730dddfa314b5c9194f16ad25182ab53e2faa0e8033e108da47e9c3666b
Opcode Fuzzy Hash: a96f2db92880f3934b0b19eea0be8f60c2c27bdad88fd431c7dcc4505a68df2e
Instruction Fuzzy Hash: 83F037606046549ADB12EA6948C5BD722986B08308F49C07BFD4DDF287CA3D8C9647AE

Uniqueness

Uniqueness Score: -1.00%

Function 00470DF4, Relevance: 3.0, APIs: 2, Instructions: 20threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(Function_00070D90,00000000,00000000,00477D02,00000000,00477D85), ref: 00470E10
EnumThreadWindows.USER32(00000000,Function_00070D90,00000000,00000000,00477D02,00000000,00477D85), ref: 00470E16

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 4c2b7df2050537dcc697687328395940cdff7f639f099ba98a7d8b6054a976fb
Instruction ID: 1b3dd6edd73c59a64c40b4e4f47280d5ccb31ab0e56070ce71c716d3a2a9c656
Opcode Fuzzy Hash: 4c2b7df2050537dcc697687328395940cdff7f639f099ba98a7d8b6054a976fb
Instruction Fuzzy Hash: 68E0B6F1522200AFE710EBB9AC8078B36D4B368309F118426A208D2262DB385C68AF18

Uniqueness

Uniqueness Score: -1.00%

Function 0042E8C4, Relevance: 3.0, APIs: 2, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegFlushKey.ADVAPI32(00000000,?,0042E930,?,?,00000000,0042EAF3,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0042E8D5
RegCloseKey.ADVAPI32(00000000,?,0042E930,?,?,00000000,0042EAF3,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0042E8DE

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: df33765353220e4c7802b6f24250d6e5bba6922a33b9661bffe03f009a2cbe0f
Instruction ID: ef365963f3d84e84352704aa8bc8693835b3b9ff0505f2763e7e6db962fa954c
Opcode Fuzzy Hash: df33765353220e4c7802b6f24250d6e5bba6922a33b9661bffe03f009a2cbe0f
Instruction Fuzzy Hash: 4EE0EC607002108BDF54EE7685C560777D86B08204B48C4B7A909DF28BD67CC8008B25

Uniqueness

Uniqueness Score: -1.00%

Function 0042BF1C, Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC,?,?,004B23FE,004FFAA5), ref: 0042BF23
DestroyWindow.USER32(00000000,00000000,000000FC,?,?,004B23FE,004FFAA5), ref: 0042BF2B

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$DestroyLong
String ID:
API String ID: 2871862000-0
Opcode ID: cb3cddb240444225160cf4031bf0aa7d739278d0abcd4ad76004631c4938290f
Instruction ID: ea845e06ddbba83a3817ad33fa0c0f04bfa99fb0ef3c76058846412d9c8d5df0
Opcode Fuzzy Hash: cb3cddb240444225160cf4031bf0aa7d739278d0abcd4ad76004631c4938290f
Instruction Fuzzy Hash: 63C0124231223026DA10366A3CC18BB524CC8423783A2023BFA20E62D3CB2C5D4102ED

Uniqueness

Uniqueness Score: -1.00%

Function 00471C48, Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

FlatSB_SetScrollInfo.COMCTL32(00000000,0000001C,0000001C,000000FF,?,?,?), ref: 00471D0B

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FlatInfoScroll
String ID:
API String ID: 3347635785-0
Opcode ID: 0b8e56398f003af2e37094571e4d2350b2c0b456a7a3a603069d487ec9884b64
Instruction ID: 120015236aabeb82b02f7ffea1396f52e802722a8f2ca33459757ce2491564c7
Opcode Fuzzy Hash: 0b8e56398f003af2e37094571e4d2350b2c0b456a7a3a603069d487ec9884b64
Instruction Fuzzy Hash: 70416A74A041449FD754CFAEC084E9AFBF6AF59340B2584AEE4C8D7362D635EE04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004435F0, Relevance: 1.6, APIs: 1, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A124: CreateWindowExW.USER32(00000000,TWindowDisabler-Window,00000000,00481636,?,?,000000EC,00000001,00000000,?,004B36C3,?,00480FE0,000000EC,00000001,0048165C), ref: 0040A163

SendMessageW.USER32(00000000,000000CF,00000001,00000000,?,00400000,00000000,?,?,?,?,00000000,?,00000000,004436EB), ref: 00443674

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateMessageSendWindow
String ID:
API String ID: 304178485-0
Opcode ID: 9ad5f22b01e1bf0260bc3c7310ff3955115fa5b76391668ade403d58eac17bbf
Instruction ID: 78c0a7c83e9f7eedf3a690392948dcfc4048e2da730daa62a2656c98a0f3c224
Opcode Fuzzy Hash: 9ad5f22b01e1bf0260bc3c7310ff3955115fa5b76391668ade403d58eac17bbf
Instruction Fuzzy Hash: 48310671200200AFEB64DF5CC8C1F5777EDAB48700F1584A9BA08CB29AC734ED11CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00423154, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,00000000,0000000A,?,108B0050,00000000,004233F1,?,00423320,00000000,00423338,?,0000FFA6,00000000,00000000), ref: 00423176

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: c785f78ab7e053999886eeb6a0a8530e294ddf5b46f333be9426769c0bb67927
Instruction ID: d83abdbb36bee4ce74130ea906b9ae3d92750d4c279a6444d5173473d538e5e0
Opcode Fuzzy Hash: c785f78ab7e053999886eeb6a0a8530e294ddf5b46f333be9426769c0bb67927
Instruction Fuzzy Hash: 2801F271304300AFD711EF6AEC9292AB7EDEB89714B92447BF500D7391DA3A9D119628

Uniqueness

Uniqueness Score: -1.00%

Function 004AA574, Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000435,00000000,7FFFFFFE), ref: 004AA5CF

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6c46a786066b019319949bd056964cbf4cd8be2bd46f6d567d02fc0769c5dedd
Instruction ID: 4b6da996204791041e67876325424c14150e593b4768222b6ccbe584f4b48dcf
Opcode Fuzzy Hash: 6c46a786066b019319949bd056964cbf4cd8be2bd46f6d567d02fc0769c5dedd
Instruction Fuzzy Hash: 4501C430E08208BFD710EFA9C882A5EB7F8DB19304F61817AB414A32D1DF78AA50C51D

Uniqueness

Uniqueness Score: -1.00%

Function 004AA4EC, Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000449,?,?), ref: 004AA567

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6fbb1a247c1c6e391191bb6fbbf70efa3e95e654f6dc0de85f75806ad8e0d606
Instruction ID: 9e298ea26f21361286ffd13b081373311e609ad571afdb0fb4f40818505fd9da
Opcode Fuzzy Hash: 6fbb1a247c1c6e391191bb6fbbf70efa3e95e654f6dc0de85f75806ad8e0d606
Instruction Fuzzy Hash: 03111870E01209AFCB10CFA9C58999EBBF4EB08314F0080A6E948E7351E3349E40CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00483C58, Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,00483D48,00000000,00000000,00483CB3,?,00000000,00483D38), ref: 00483C9F

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 03aacce8d1a86b31e60050ff3bf1f1bf86e1f9219380de732fed084bcb77505d
Instruction ID: 9450cae558b0450a40e127b848148d3582622c3f4e9435d2f6f74bf1142714ff
Opcode Fuzzy Hash: 03aacce8d1a86b31e60050ff3bf1f1bf86e1f9219380de732fed084bcb77505d
Instruction Fuzzy Hash: 9C01A771608744BFD705AF69DC1295EBBECEB49F11F62487BF401E2681E63D5A108A2C

Uniqueness

Uniqueness Score: -1.00%

Function 0042EC24, Relevance: 1.5, APIs: 1, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?), ref: 0042EC4F

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: af11eb4f5c2923d4f816e62e186a07cf2c86bd09eb1aa62cd4f58a4381ae3a03
Instruction ID: 323a7f79aebc1854ff66605b4b15727f124d33b6eb1b040d9558fdcc95a1c0e9
Opcode Fuzzy Hash: af11eb4f5c2923d4f816e62e186a07cf2c86bd09eb1aa62cd4f58a4381ae3a03
Instruction Fuzzy Hash: 4D014475B00208AFD710DF9ADC81EDEB7ACDB59314F008166FD14D7351D6749E0497A5

Uniqueness

Uniqueness Score: -1.00%

Function 00460090, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(00000000,Function_0006004C), ref: 004600EC

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ChildEnumWindows
String ID:
API String ID: 3555792229-0
Opcode ID: bdcff877b38cd297bd1d8a1760c7fd04c5056363f839a20197ccae92580e26d8
Instruction ID: fb05890601aac6ec164e9032bfd75d4473e07c0bfada85330ff596875ca779ca
Opcode Fuzzy Hash: bdcff877b38cd297bd1d8a1760c7fd04c5056363f839a20197ccae92580e26d8
Instruction Fuzzy Hash: 6D01D1313057418BD3209A2DD888B97F7E9EF81314F14866AE49987292DB349C85CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5CC, Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,00421538,004264A6,00000000,00426524,?,?,00421538), ref: 0040D61A

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e922713b7f71394fc34abb1de62249ee1ee4e428830d572faae951356c7b2b36
Instruction ID: 61111611453d71fa4e79a7d8e62ffff56049d55b418f99014c346a8370a9dc8f
Opcode Fuzzy Hash: e922713b7f71394fc34abb1de62249ee1ee4e428830d572faae951356c7b2b36
Instruction Fuzzy Hash: F0E06DA3B8051426E270A99D9CC2B8BA14ECB89769F194537F215EB3C1C0BD8D066368

Uniqueness

Uniqueness Score: -1.00%

Function 00415064, Relevance: 1.5, APIs: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,00000000,00000000,004150AF), ref: 00415092

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2080a6b79f357db5d8ae65611ac70139cc131f44947aa9cca1e9025161c97405
Instruction ID: 37b458e0cf7a9ea8cdca27fb5ba37c12cc635f505dd3ba39ed9a0a68aa29389f
Opcode Fuzzy Hash: 2080a6b79f357db5d8ae65611ac70139cc131f44947aa9cca1e9025161c97405
Instruction Fuzzy Hash: B0E06D712046147FD711EA6ACC52C977FDCDB8EB54392843AB809D3692DA789C1085AC

Uniqueness

Uniqueness Score: -1.00%

Function 004A4CB8, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

DrawTextW.USER32(?,00000000,00000000,?,?,00000000,?,?,?,?,004A4FE8,00000000,?,00000000,00000000,004A5001), ref: 004A4CE3

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 9b2e8cf4f82569da315d8cb9f0f96fcd42e4230dbbf34965f26eafb484694d39
Instruction ID: 303cbe915e099ebc2e6bccaa985035c29f1cbc352462145c2e0b203ca032f1bc
Opcode Fuzzy Hash: 9b2e8cf4f82569da315d8cb9f0f96fcd42e4230dbbf34965f26eafb484694d39
Instruction Fuzzy Hash: 1BE04FB37052147F6704DA9E9DC1D6BB7ECDA99664711403AFA08D3301D574AD0192B8

Uniqueness

Uniqueness Score: -1.00%

Function 00480914, Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,004AACCA,00000000,004AAD1B,?,004AAEFC), ref: 00480933

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 14165ddeca9d9ca73544aca47b7726fcc7323ef4d54f909cb1c146b21baf70b4
Instruction ID: 8256a98103065aead44ffb83a1dae23bd3a2d36c4c835986f729743aa7be81b5
Opcode Fuzzy Hash: 14165ddeca9d9ca73544aca47b7726fcc7323ef4d54f909cb1c146b21baf70b4
Instruction Fuzzy Hash: 12E0D8B076431225F22431090C53B7F104987C0B14FA0883AF6549D3EBD6AD985A939E

Uniqueness

Uniqueness Score: -1.00%

Function 0047EB88, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,00000000,0047EBCE,?,00000000,00000000,?,0047EC1E,00000000,004AD5C5,00000000,004AD5E6,?,00000000,00000000,00000000), ref: 0047EBB1

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 928c1dcf4afabc09d6dab8d5173f5cd5f10dff09ebc7358ab2ae0fb875d72abd
Instruction ID: 4016bb98e3e98d4c27f0492b86c6865ae33db02e2fa469f0cebafe4b3850542a
Opcode Fuzzy Hash: 928c1dcf4afabc09d6dab8d5173f5cd5f10dff09ebc7358ab2ae0fb875d72abd
Instruction Fuzzy Hash: F8E09231304308BFD701EBB7CC52D59B7ECD74C714BA288B6B406E3682E679AE10951C

Uniqueness

Uniqueness Score: -1.00%

Function 0045FE94, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,0045FEE1), ref: 0045FEBC

Part of subcall function 0041362C: GetLastError.KERNEL32(0040AA79,00000000,00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040A9F4,00000000,00451B55,00000000,00451C6F), ref: 0041362C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: DestroyErrorLastWindow
String ID:
API String ID: 1182162058-0
Opcode ID: ac02f9e499c483fcf9d0b6fdd688d902f9752d059000ac7c0c7fe48563f186d3
Instruction ID: 8c3a49863418359358daf6c59a811537055cc678c3e5b40d4ca9b3ff46b068e1
Opcode Fuzzy Hash: ac02f9e499c483fcf9d0b6fdd688d902f9752d059000ac7c0c7fe48563f186d3
Instruction Fuzzy Hash: B7F0A031604704EFDB11CFA9DA56D1EB7F8EB08700B6200B6F800D7622E338EE08E619

Uniqueness

Uniqueness Score: -1.00%

Function 004080D0, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 004080EE

Part of subcall function 00408370: GetModuleFileNameW.KERNEL32(00000000,?,00000105,?,00000000), ref: 0040838C
Part of subcall function 00408370: RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,?,00000000), ref: 004083AC
Part of subcall function 00408370: RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,?,00000000), ref: 004083CA
Part of subcall function 00408370: RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000), ref: 004083E8
Part of subcall function 00408370: RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00408406
Part of subcall function 00408370: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,004084A4,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?), ref: 0040844F
Part of subcall function 00408370: RegQueryValueExW.ADVAPI32(?,00408698,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,004084A4,?,80000001), ref: 0040846D
Part of subcall function 00408370: RegCloseKey.ADVAPI32(?,004084AB,00000000,?,?,00000000,004084A4,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0040849E

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 6d7ca68d75fa4230207e8bf5216afb727d6242516d6ec55213392f30d600521f
Instruction ID: 3970bc2d34380e59235853d60ecf92922676daedb8835f9a67ac2a530b45cafe
Opcode Fuzzy Hash: 6d7ca68d75fa4230207e8bf5216afb727d6242516d6ec55213392f30d600521f
Instruction Fuzzy Hash: 02E0C971A003209BCB14DE58C9C5A473794AF08764F0449AAED54DF396D775DD208BD5

Uniqueness

Uniqueness Score: -1.00%

Function 004AAE7C, Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004AAEB9

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b76e72283b5b3f4d9bb81a55b524dc4136f98d1740c1556c13243fcd4d749382
Instruction ID: 1f6ac67b9b3a275783fe640c9e60ce4a0d17079629a5da3141da5989a0625186
Opcode Fuzzy Hash: b76e72283b5b3f4d9bb81a55b524dc4136f98d1740c1556c13243fcd4d749382
Instruction Fuzzy Hash: 05E01A752442283AD600AA9DAC51F6B779C9B19718F048012B984DB282D06A9E189AE8

Uniqueness

Uniqueness Score: -1.00%

Function 004DFA12, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32(?,004DFA65,?,00000005,00000000,00000000,?,004FEA10,00000006,?,00000000,004FEFC1,?,00000000,004FF080), ref: 004DFA58

Strings

ProgramFilesDir, xrefs: 004DF8BD, 004DF944
Failed to get path of 64-bit Common Files directory, xrefs: 004DF995
COMMAND.COM, xrefs: 004DFAA4
Failed to get path of 64-bit Program Files directory, xrefs: 004DF966
Common Files, xrefs: 004DF92E
SystemDrive, xrefs: 004DF85A
\Program Files, xrefs: 004DF8E4
cmd.exe, xrefs: 004DFA83
CommonFilesDir, xrefs: 004DF8F7, 004DF973

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 734271698-544719455
Opcode ID: 3947d3c4bea51af834f187f2806a76cb011aa6dff367ea9590677eb1ec2215d3
Instruction ID: 2f34f94671fc2200848f15fdb5d49e7c9c18f9701b14bd415c2671b88c717bce
Opcode Fuzzy Hash: 3947d3c4bea51af834f187f2806a76cb011aa6dff367ea9590677eb1ec2215d3
Instruction Fuzzy Hash: FFE09231744B04BFE721CFA48D22F2E7BEDE749B00B610473F501D6781D6B9AD049A18

Uniqueness

Uniqueness Score: -1.00%

Function 0047FD80, Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0047FDAC

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 07d9dd372a3c1657ad0e59e165d441dcf78a6d87fab411597fd766c7e5945063
Instruction ID: 32dba8c22ea6757d2bc846171a0a9fd298f8809202904fc8e8a3c384c16b40c9
Opcode Fuzzy Hash: 07d9dd372a3c1657ad0e59e165d441dcf78a6d87fab411597fd766c7e5945063
Instruction Fuzzy Hash: C1E07EB2640119AF9B40DE8CDC81EEB37ADAB1D360F408016FE48D7241C274EC619BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004AA740, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,004AA9FB,00000000,004AAA12), ref: 004AA767

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: a0efb73b83f2df7ed56430dffbab510a4b11956dbe9298023b3d6b03c8b486fa
Instruction ID: af6ec1bfba56bf412fe56b2439bab8ab8482b177dd663ce0d38d65c3f04a1641
Opcode Fuzzy Hash: a0efb73b83f2df7ed56430dffbab510a4b11956dbe9298023b3d6b03c8b486fa
Instruction Fuzzy Hash: 09F028759212008FCBA1CF38ED6536A3EE5B36A306F85973B9405C3262F3348448EB55

Uniqueness

Uniqueness Score: -1.00%

Function 0047B4B4, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 0047B4E1

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ProcWindow
String ID:
API String ID: 181713994-0
Opcode ID: db4f92b7a301a119ff94f39521543c42caf62474005e6865e139ebdc87080deb
Instruction ID: 5cb162f3b9425c3554eccc2811f6088f8d6969fb27f58a237ed41856848cae58
Opcode Fuzzy Hash: db4f92b7a301a119ff94f39521543c42caf62474005e6865e139ebdc87080deb
Instruction Fuzzy Hash: 28F0B379205609AFCB40DF99D588D9ABBE8BB4C260B058595B988CB322C234FD818B94

Uniqueness

Uniqueness Score: -1.00%

Function 0047EC24, Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,004AD7F9,00000000,004AD812,?,?,00000000), ref: 0047EC2F

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 994c9fe930d7d43761121d6fc2ec80e0509558d8d5b078c16ae5cfa29a8a5e82
Instruction ID: b418713732a36a944a68f98f781661d709dce28213e29e43c16b20126d0ba5c7
Opcode Fuzzy Hash: 994c9fe930d7d43761121d6fc2ec80e0509558d8d5b078c16ae5cfa29a8a5e82
Instruction Fuzzy Hash: BDD012E52112001DDE2E51BF1CC67A715C80B8A338B1C8BA7B57DE13E7D27D8C52505C

Uniqueness

Uniqueness Score: -1.00%

Function 004814CC, Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 004814E8

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ProcWindow
String ID:
API String ID: 181713994-0
Opcode ID: 555bb3888fc4052e1b0342465e0bd0041f6289fa26fcdd808e3cf3ee1c3754c1
Instruction ID: a00ee74ae94d5eb5c7ced1020ff14997e1b640e7f12c73b84109f9338ff21e76
Opcode Fuzzy Hash: 555bb3888fc4052e1b0342465e0bd0041f6289fa26fcdd808e3cf3ee1c3754c1
Instruction Fuzzy Hash: 8AD09E7151010D6BDB40DD99D880C6F33ADAB98B10B508D16F959C7252D634EC529765

Uniqueness

Uniqueness Score: -1.00%

Function 0047EBDC, Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,004AC073,00000000,?), ref: 0047EBE7

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5b10bf9fbb4d7d12515ebafc74c8dcb7aeffe9d090e29c13d13aab3a81f50326
Instruction ID: 8cdc2198b4e230bed8edab22a1ed05bd902f4f16c2d179ad5ff417dd0b041afb
Opcode Fuzzy Hash: 5b10bf9fbb4d7d12515ebafc74c8dcb7aeffe9d090e29c13d13aab3a81f50326
Instruction Fuzzy Hash: CCC08CE16122101A9E10A2FF1CC518A06C8090C3383248BB7F02EE23D3E23DEC232018

Uniqueness

Uniqueness Score: -1.00%

Function 004AAFE0, Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,004B85D3,00000000,004B8765,?,00000000,00000002,00000002), ref: 004AAFE7

Part of subcall function 004AAD58: GetLastError.KERNEL32(004AAAEC,004AAE23,?,004FF8F0,00000001,00000000,00000002,00000000,004FFA91,?,?,00000005,00000000,004FFACA), ref: 004AAD5B

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 5df5224de87c856c001dcde30477782ee91dac6bb82225a2a9477a6e691a471d
Instruction ID: 496936d1ab997f53406adab80bcaeccbc740760d50816ddf0559322d4e199538
Opcode Fuzzy Hash: 5df5224de87c856c001dcde30477782ee91dac6bb82225a2a9477a6e691a471d
Instruction Fuzzy Hash: 12C02BE13001418BCF00EABEC4C0E0A63CC1F1D3083000066B40CCF207D328CC10C315

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD74, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32(00000000,?,004FF87E,00000000,004FFA91,?,?,00000005,00000000,004FFACA,?,?,00000000,?), ref: 0040DD7F

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 24980ef6958087dadf957bde690df4a2ff3f33da896d1f21b1940bdce3b6ac9c
Instruction ID: 760e6ac4e30c85a6c7c9acfda4d72fc248caca873c4b92e09980cd14d23c5683
Opcode Fuzzy Hash: 24980ef6958087dadf957bde690df4a2ff3f33da896d1f21b1940bdce3b6ac9c
Instruction Fuzzy Hash: C7B012E3F302401ACB007AFE0CC180D00CC951860E7110C3FB006E31D3D43EC8140118

Uniqueness

Uniqueness Score: -1.00%

Function 004E0438, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,004FFB54,00000000,004FFB63,?,?,?,?,?,0050063F), ref: 004E044E

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 664c9d3ca1c5637357f1614924c4633cda6c46f11409f72f79e89f72f3dcaae4
Instruction ID: ed12c2b4405fd03622ab28453c81a31c7c8898b4d716a77198b381550b20c144
Opcode Fuzzy Hash: 664c9d3ca1c5637357f1614924c4633cda6c46f11409f72f79e89f72f3dcaae4
Instruction Fuzzy Hash: 06C04CB59502009EC741DFFAED0A71976F5A36D306F08893AA114C32A1EF78855AEFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00413D03, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00413D21), ref: 00413D14

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 47a17f19a5a3ec662581f71b3758b765df4e640b5114d6779749de70448dcdfc
Instruction ID: bda29fee4f8aced95ac472a93069eb49bdab83691d8588fe2ead8eab6b5224d9
Opcode Fuzzy Hash: 47a17f19a5a3ec662581f71b3758b765df4e640b5114d6779749de70448dcdfc
Instruction Fuzzy Hash: 14B09B7B61C2045DF709DEE5B41145873E4D7C47107A18477F400D35C1D53C5900461C

Uniqueness

Uniqueness Score: -1.00%

Function 0042BDA0, Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,0050CC38,00000000,00000000,?,0042BF03,00000000,00000B06,00000000,00400000,00000000,00000000,00000000), ref: 0042BDBE

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e002715c4554f371e7818c6cf6b5c6522e4e7bc1375122956f647bb45db4fe64
Instruction ID: b43e0172af1037d74ad7f7c7bfd642b7ca68c17faccf6b2da66985b762ea7649
Opcode Fuzzy Hash: e002715c4554f371e7818c6cf6b5c6522e4e7bc1375122956f647bb45db4fe64
Instruction Fuzzy Hash: 92118C743403159FD710DF19D880B86BBE9EF58350F50C53AE9588B386D3B4E9058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004ADB70, Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004ADBDC), ref: 004ADBBE

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 638aec3770d942f07ff91a578bacf094b5ef9411dae8c5a0de3f8febc76a0365
Instruction ID: 4b569115a2330e99b4fb434722d7ff5924f40164e1dbf50dd8ad96ff7ea104b0
Opcode Fuzzy Hash: 638aec3770d942f07ff91a578bacf094b5ef9411dae8c5a0de3f8febc76a0365
Instruction Fuzzy Hash: 5A01FC31A042086F8711DB6A9C014BEBBECDB5B32075142B7F855D3681DB389E109764

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004344E0, Relevance: 58.2, APIs: 32, Strings: 1, Instructions: 500
windowCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E004344E0(struct HBITMAP__* __eax, struct HPALETTE__* __ecx, struct HPALETTE__* __edx, intOrPtr _a4, signed int _a8) {
				struct HBITMAP__* _v8;
				struct HPALETTE__* _v12;
				struct HPALETTE__* _v16;
				struct HPALETTE__* _v20;
				void* _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				struct HDC__* _v36;
				struct HPALETTE__* _v40;
				BITMAPINFO* _v44;
				void* _v48;
				intOrPtr _v52;
				struct tagRGBQUAD _v56;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v132;
				char _v136;
				void _v140;
				struct tagRECT _v156;
				void* __ebx;
				void* __ebp;
				signed int _t229;
				int _t281;
				signed int _t290;
				signed short _t292;
				struct HBRUSH__* _t366;
				struct HPALETTE__* _t422;
				signed int _t441;
				intOrPtr _t442;
				intOrPtr _t444;
				intOrPtr _t445;
				void* _t455;
				void* _t457;
				void* _t459;
				intOrPtr _t460;

				_t457 = _t459;
				_t460 = _t459 + 0xffffff68;
				_push(_t419);
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v20 = 0;
				if( *(_a8 + 0x18) == 0 ||  *(_a8 + 0x1c) != 0 &&  *(_a8 + 0x20) != 0) {
					if( *(_a8 + 0x18) != 0 ||  *(_a8 + 4) != 0 &&  *(_a8 + 8) != 0) {
						E0043406C(_v8);
						_v116 = 0;
						if(_v8 != 0 && GetObjectW(_v8, 0x54,  &_v140) < 0x18) {
							E004328D0();
						}
						_v28 = E004329E4(GetDC(0));
						_v32 = E004329E4(CreateCompatibleDC(_v28));
						_push(_t457);
						_push(0x434b2e);
						_push( *[fs:edx]);
						 *[fs:edx] = _t460;
						if( *(_a8 + 0x18) >= 0x28) {
							_v44 = E00403018(0x42c);
							_push(_t457);
							_push(0x434838);
							_push( *[fs:edx]);
							 *[fs:edx] = _t460;
							 *(_a8 + 0x18) = 0x28;
							 *((short*)(_a8 + 0x24)) = 1;
							if( *(_a8 + 0x26) == 0) {
								_t290 = GetDeviceCaps(_v28, 0xc);
								_t292 = GetDeviceCaps(_v28, 0xe);
								_t419 = _t290 * _t292;
								 *(_a8 + 0x26) = _t290 * _t292;
							}
							_t55 = _a8 + 0x18; // 0x18
							memcpy(_v44, _t55, 0xa << 2);
							 *(_a8 + 4) =  *(_a8 + 0x1c);
							_t441 = _a8;
							 *(_t441 + 8) =  *(_a8 + 0x20);
							if( *(_a8 + 0x26) > 8) {
								_t229 =  *(_a8 + 0x26) & 0x0000ffff;
								if(_t229 == 0x10) {
									L30:
									if(( *(_a8 + 0x28) & 0x00000003) != 0) {
										E00434494(_a8);
										_t104 =  &(_v44->bmiColors); // 0x28
										_t441 = _t104;
										E004031D0(_a8 + 0x40, 0xc, _t441);
									}
								} else {
									_t441 = _a8;
									if(_t229 == 0x20) {
										goto L30;
									}
								}
							} else {
								if( *(_a8 + 0x26) != 1 || _v8 != 0 && _v120 != 0) {
									if(_v16 == 0) {
										if(_v8 != 0) {
											_v24 = SelectObject(_v32, _v8);
											if(_v116 <= 0 || _v120 == 0) {
												asm("cdq");
												GetDIBits(_v32, _v8, 0, ( *(_a8 + 0x20) ^ _t441) - _t441, 0, _v44, 0);
											} else {
												_t281 = GetDIBColorTable(_v32, 0, 0x100,  &(_v44->bmiColors));
												_t441 = _a8;
												 *(_t441 + 0x38) = _t281;
											}
											SelectObject(_v32, _v24);
										}
									} else {
										_t76 =  &(_v44->bmiColors); // 0x28
										_t441 = _t76;
										E00433180(_v16, 0xff, _t441);
									}
								} else {
									_t441 = 0;
									_v44->bmiColors = 0;
									 *((intOrPtr*)(_v44 + 0x2c)) = 0xffffff;
								}
							}
							_v20 = E004329E4(CreateDIBSection(_v28, _v44, 0,  &_v48, 0, 0));
							if(_v48 == 0) {
								E0043293C(_t419);
							}
							if(_v8 == 0) {
								L39:
								_pop(_t442);
								 *[fs:eax] = _t442;
								_push(0x43483f);
								return E00403034(_v44);
							} else {
								_t114 =  &_v136; // 0x434b2e
								if( *(_a8 + 0x1c) !=  *_t114 ||  *(_a8 + 0x20) != _v132 ||  *(_a8 + 0x26) <= 8) {
									goto L39;
								} else {
									asm("cdq");
									GetDIBits(_v32, _v8, 0, ( *(_a8 + 0x20) ^ _t441) - _t441, _v48, _v44, 0);
									E00404B68();
									E00404B68();
									goto L58;
								}
							}
						} else {
							if(( *(_a8 + 0x10) & 0x0000ffff |  *(_a8 + 0x12)) != 1) {
								_v20 = E004329E4(CreateCompatibleBitmap(_v28,  *(_a8 + 4),  *(_a8 + 8)));
							} else {
								_v20 = E004329E4(CreateBitmap( *(_a8 + 4),  *(_a8 + 8), 1, 1, 0));
							}
							E004329E4(_v20);
							_v24 = E004329E4(SelectObject(_v32, _v20));
							_push(_t457);
							_push(0x434adf);
							_push( *[fs:eax]);
							 *[fs:eax] = _t460;
							_push(_t457);
							_push(0x434ace);
							_push( *[fs:eax]);
							 *[fs:eax] = _t460;
							_v40 = 0;
							_t422 = 0;
							if(_v16 != 0) {
								_v40 = SelectPalette(_v32, _v16, 0);
								RealizePalette(_v32);
							}
							_push(_t457);
							_push(0x434aac);
							_push( *[fs:eax]);
							 *[fs:eax] = _t460;
							if(_a4 == 0) {
								PatBlt(_v32, 0, 0,  *(_a8 + 4),  *(_a8 + 8), 0xff0062);
							} else {
								_t366 = E004317A4( *((intOrPtr*)(_a4 + 0x14)));
								E00409158(0,  *(_a8 + 4), 0,  &_v156,  *(_a8 + 8));
								FillRect(_v32,  &_v156, _t366);
								SetTextColor(_v32, E00430758( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0xc)) + 0x18))));
								SetBkColor(_v32, E00430758(E00431748( *((intOrPtr*)(_a4 + 0x14)))));
								if( *(_a8 + 0x26) == 1 &&  *((intOrPtr*)(_a8 + 0x14)) != 0) {
									_v56 = E00430758( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0xc)) + 0x18)));
									_v52 = E00430758(E00431748( *((intOrPtr*)(_a4 + 0x14))));
									SetDIBColorTable(_v32, 0, 2,  &_v56);
								}
							}
							if(_v8 == 0) {
								_pop(_t444);
								 *[fs:eax] = _t444;
								_push(0x434ab3);
								if(_v16 != 0) {
									return SelectPalette(_v32, _v40, 0xffffffff);
								}
								return 0;
							} else {
								_v36 = E004329E4(CreateCompatibleDC(_v28));
								_push(_t457);
								_push(0x434a82);
								_push( *[fs:eax]);
								 *[fs:eax] = _t460;
								_t455 = E004329E4(SelectObject(_v36, _v8));
								if(_v12 != 0) {
									_t422 = SelectPalette(_v36, _v12, 0);
									RealizePalette(_v36);
								}
								if(_a4 != 0) {
									SetTextColor(_v36, E00430758( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0xc)) + 0x18))));
									SetBkColor(_v36, E00430758(E00431748( *((intOrPtr*)(_a4 + 0x14)))));
								}
								BitBlt(_v32, 0, 0,  *(_a8 + 4),  *(_a8 + 8), _v36, 0, 0, 0xcc0020);
								if(_v12 != 0) {
									SelectPalette(_v36, _t422, 0xffffffff);
								}
								E004329E4(SelectObject(_v36, _t455));
								_pop(_t445);
								 *[fs:eax] = _t445;
								_push(0x434a89);
								return DeleteDC(_v36);
							}
						}
					} else {
						goto L58;
					}
				} else {
					L58:
					return _v20;
				}
			}

0x004344e1
0x004344e3
0x004344e9
0x004344ec
0x004344ef
0x004344f2
0x004344f7
0x00434501
0x00434524
0x00434543
0x0043454a
0x00434551
0x0043456a
0x0043456a
0x0043457b
0x0043458c
0x00434591
0x00434592
0x00434597
0x0043459a
0x004345a4
0x0043460e
0x00434613
0x00434614
0x00434619
0x0043461c
0x00434622
0x0043462c
0x0043463a
0x00434642
0x0043464f
0x00434654
0x0043465b
0x0043465b
0x00434665
0x0043466f
0x0043467a
0x00434683
0x00434686
0x00434691
0x00434761
0x00434769
0x00434774
0x0043477b
0x00434780
0x00434788
0x00434788
0x00434796
0x00434796
0x0043476b
0x0043476b
0x00434772
0x00000000
0x00000000
0x00434772
0x00434697
0x0043469f
0x004346cd
0x004346eb
0x004346fe
0x00434705
0x0043473a
0x0043474a
0x0043470d
0x0043471f
0x00434724
0x00434727
0x00434727
0x00434757
0x00434757
0x004346cf
0x004346d2
0x004346d2
0x004346dd
0x004346dd
0x004346ad
0x004346b0
0x004346b2
0x004346be
0x004346be
0x0043469f
0x004347b7
0x004347be
0x004347c0
0x004347c0
0x004347c9
0x00434822
0x00434824
0x00434827
0x0043482a
0x00434837
0x004347cb
0x004347d1
0x004347d7
0x00000000
0x004347ee
0x004347fe
0x0043480e
0x00434813
0x00434818
0x00000000
0x00434818
0x004347d7
0x004345a6
0x004345b8
0x004345fc
0x004345ba
0x004345d8
0x004345d8
0x00434842
0x00434859
0x0043485e
0x0043485f
0x00434864
0x00434867
0x0043486c
0x0043486d
0x00434872
0x00434875
0x0043487a
0x0043487d
0x00434883
0x00434894
0x0043489b
0x0043489b
0x004348a2
0x004348a3
0x004348a8
0x004348ab
0x004348b2
0x00434988
0x004348b8
0x004348be
0x004348dc
0x004348ec
0x00434904
0x0043491e
0x0043492b
0x00434944
0x00434957
0x00434966
0x00434966
0x0043492b
0x00434991
0x00434a8b
0x00434a8e
0x00434a91
0x00434a9a
0x00000000
0x00434aa6
0x00434aab
0x00434997
0x004349a5
0x004349aa
0x004349ab
0x004349b0
0x004349b3
0x004349c8
0x004349ce
0x004349df
0x004349e5
0x004349e5
0x004349ee
0x00434a03
0x00434a1d
0x00434a1d
0x00434a45
0x00434a4e
0x00434a57
0x00434a57
0x00434a66
0x00434a6d
0x00434a70
0x00434a73
0x00434a81
0x00434a81
0x00434991
0x00000000
0x00000000
0x00000000
0x00434b35
0x00434b35
0x00434b3e
0x00434b3e

APIs

GetObjectW.GDI32(00000000,00000054,?,00000000,?,00000000,?,00434CAA,00000000,?,00000000,00434D5B,?,?,?,00000000), ref: 00434560
GetDC.USER32(00000000,00000000,?,00000000,?,00434CAA,00000000,?,00000000,00434D5B,?,?,?,00000000,?,?), ref: 00434571
CreateCompatibleDC.GDI32(00000000,00000000,00000000,?,00000000,?,00434CAA,00000000,?,00000000,00434D5B,?,?,?,00000000,?), ref: 00434582
CreateBitmap.GDI32(?,?,00000001,00000001,00000000,00000000,00434B2E,?,00000000,00000000,00000000,?,00000000,?,00434CAA,00000000), ref: 004345CE
CreateCompatibleBitmap.GDI32(00000000,?,?,00000000,00434B2E,?,00000000,00000000,00000000,?,00000000,?,00434CAA,00000000,?,00000000), ref: 004345F2
SelectObject.GDI32(?,?,00000000,?,?,00000000,00434B2E,?,00000000,00000000,00000000,?,00000000,?,00434CAA,00000000), ref: 0043484F
SelectPalette.GDI32(?,00000000,00000000,00000000,00434ACE,?,00000000,00434ADF,?,?,?,00000000,?,?,00000000,00434B2E), ref: 0043488F
RealizePalette.GDI32(?,?,00000000,00000000,00000000,00434ACE,?,00000000,00434ADF,?,?,?,00000000,?,?,00000000), ref: 0043489B
SetTextColor.GDI32(?,00000000,?,?,?,?,00000000,00000000,00434AAC,?,00000000,00434ACE,?,00000000,00434ADF), ref: 00434904
SetBkColor.GDI32(?,00000000,?,00000000,?,?,?,?,00000000,00000000,00434AAC,?,00000000,00434ACE,?,00000000), ref: 0043491E
SetDIBColorTable.GDI32(?,00000000,00000002,00000001,?,00000000,?,00000000,?,?,?,?,00000000,00000000,00434AAC), ref: 00434966
FillRect.USER32(?,?,?,?,00000000,00000000,00434AAC,?,00000000,00434ACE,?,00000000,00434ADF,?,?,?), ref: 004348EC

Part of subcall function 00430758: GetSysColor.USER32(?,00431848,00000000,00431872), ref: 00430762

PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062,00000000,00434AAC,?,00000000,00434ACE,?,00000000,00434ADF,?,?), ref: 00434988
CreateCompatibleDC.GDI32(00000000,?,00000000,00000000,?,?,00FF0062,00000000,00434AAC,?,00000000,00434ACE,?,00000000,00434ADF), ref: 0043499B
SelectObject.GDI32(00434DA3,00000000,00000000,00434A82,?,00000000,?,00000000,00000000,?,?,00FF0062,00000000,00434AAC,?,00000000), ref: 004349BE
SelectPalette.GDI32(00434DA3,00000000,00000000,00434DA3,00000000,00000000,00434A82,?,00000000,?,00000000,00000000,?,?,00FF0062,00000000), ref: 004349DA
RealizePalette.GDI32(00434DA3,00434DA3,00000000,00000000,00434DA3,00000000,00000000,00434A82,?,00000000,?,00000000,00000000,?,?,00FF0062), ref: 004349E5
SetTextColor.GDI32(00434DA3,00000000,00434DA3,00000000,00000000,00434A82,?,00000000,?,00000000,00000000,?,?,00FF0062,00000000,00434AAC), ref: 00434A03
SetBkColor.GDI32(00434DA3,00000000,00434DA3,00000000,00434DA3,00000000,00000000,00434A82,?,00000000,?,00000000,00000000,?,?,00FF0062), ref: 00434A1D
BitBlt.GDI32(?,00000000,00000000,?,?,00434DA3,00000000,00000000,00CC0020,00434DA3,00000000,00000000,00434A82,?,00000000,?), ref: 00434A45
SelectPalette.GDI32(00434DA3,00000000,000000FF,?,00000000,00000000,?,?,00434DA3,00000000,00000000,00CC0020,00434DA3,00000000,00000000,00434A82), ref: 00434A57
SelectObject.GDI32(00434DA3,00000000,?,00000000,00000000,?,?,00434DA3,00000000,00000000,00CC0020,00434DA3,00000000,00000000,00434A82), ref: 00434A61
DeleteDC.GDI32(00434DA3,00434A89,00000000,00000000,?,?,00434DA3,00000000,00000000,00CC0020,00434DA3,00000000,00000000,00434A82,?,00000000), ref: 00434A7C

Part of subcall function 004317A4: CreateBrushIndirect.GDI32(00000001,00000000,00431872), ref: 0043184F

Strings

.KC, xrefs: 004347D1

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ColorSelect$CreatePalette$Object$Compatible$BitmapRealizeText$BrushDeleteFillIndirectRectTable
String ID: .KC
API String ID: 1299887459-835335196
Opcode ID: 01d6e95545c814bbd6d4960eee5d4c05fbc2951e24216b05345b36ade4a8aa08
Instruction ID: 7dbfecce122e2e9fc275a501a3597580e3a11769aca2324a3d3d16c544b37989
Opcode Fuzzy Hash: 01d6e95545c814bbd6d4960eee5d4c05fbc2951e24216b05345b36ade4a8aa08
Instruction Fuzzy Hash: CB12D975A00208AFDB54EFA9C885F9EB7B8EB4C314F109556F914EB292C778ED40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004B39E4, Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 187
pipeprocessfileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004B39E4(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				char _v12;
				char _v16;
				void* _v20;
				void* _v24;
				long _v28;
				struct _STARTUPINFOW _v96;
				struct _PROCESS_INFORMATION _v112;
				char _v116;
				long _v120;
				char _v124;
				long _v128;
				char _v132;
				intOrPtr _v136;
				char _v140;
				intOrPtr _v144;
				char _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v164;
				void* _v168;
				char _v172;
				char _v176;
				char _v180;
				char _v184;
				char* _t62;
				WCHAR* _t91;
				WCHAR* _t97;
				intOrPtr _t98;
				void* _t127;
				intOrPtr _t140;
				struct _FILETIME* _t142;
				void* _t146;
				void* _t147;
				intOrPtr _t148;

				_t146 = _t147;
				_t148 = _t147 + 0xffffff4c;
				_v156 = 0;
				_v160 = 0;
				_v16 = 0;
				_t127 = __eax;
				_t142 =  &_v12;
				_push(_t146);
				_push(0x4b3cdf);
				_push( *[fs:eax]);
				 *[fs:eax] = _t148;
				E004B2F34(L"Starting 64-bit helper process.", __eax, __ecx, _t142, 0x50cc60);
				_t62 =  *0x505acc; // 0x50d05a
				if( *_t62 == 0) {
					E004ADE4C(L"Cannot utilize 64-bit features on this version of Windows", _t127);
				}
				if( *0x50cc5c == 0) {
					E004ADE4C(L"64-bit helper EXE wasn\'t extracted", _t127);
				}
				while(1) {
					 *0x50cc60 =  *0x50cc60 + 1;
					 *((intOrPtr*)(_t127 + 0x14)) = GetTickCount();
					if(QueryPerformanceCounter(_t142) == 0) {
						GetSystemTimeAsFileTime(_t142);
					}
					_v152 = GetCurrentProcessId();
					_v148 = 0;
					_v144 =  *0x50cc60;
					_v140 = 0;
					_v136 =  *((intOrPtr*)(_t127 + 0x14));
					_v132 = 0;
					_v128 = _t142->dwHighDateTime;
					_v124 = 0;
					_v120 = _t142->dwLowDateTime;
					_v116 = 0;
					E0040E2C8(L"\\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x", 4,  &_v152,  &_v16);
					_v20 = CreateNamedPipeW(E004064D4(_v16), 0x40080003, 6, 1, 0x2000, 0x2000, 0, 0);
					if(_v20 != 0xffffffff) {
						break;
					}
					if(GetLastError() != 0xe7) {
						E004ADFA0(L"CreateNamedPipe");
					}
				}
				_push(_t146);
				_push(0x4b3c9b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t148;
				_v24 = CreateFileW(E004064D4(_v16), 0xc0000000, 0, 0x505380, 3, 0, 0);
				if(_v24 == 0xffffffff) {
					E004ADFA0(L"CreateFile");
				}
				_push(_t146);
				_push(0x4b3c8a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t148;
				_v28 = 2;
				if(SetNamedPipeHandleState(_v24,  &_v28, 0, 0) == 0) {
					E004ADFA0(L"SetNamedPipeHandleState");
				}
				E00403540( &_v96, 0x44);
				_v96.cb = 0x44;
				E0047F7D8( &_v156);
				_t91 = E004064D4(_v156);
				_v176 = 0x69;
				_v172 = 0;
				_v168 = _v24;
				_v164 = 0;
				E0040E2C8(L"helper %d 0x%x", 1,  &_v176,  &_v160);
				_t97 = E004064D4(_v160);
				_t98 =  *0x50cc5c; // 0x0
				if(CreateProcessW(E004064D4(_t98), _t97, 0, 0, 0xffffffff, 0xc000000, 0, _t91,  &_v96,  &_v112) == 0) {
					E004ADFA0(L"CreateProcess");
				}
				 *((char*)(_t127 + 4)) = 1;
				 *((char*)(_t127 + 5)) = 0;
				 *(_t127 + 8) = _v112.hProcess;
				 *((intOrPtr*)(_t127 + 0x10)) = _v112.dwProcessId;
				 *((intOrPtr*)(_t127 + 0xc)) = _v20;
				_v20 = 0;
				CloseHandle(_v112.hThread);
				_v184 =  *((intOrPtr*)(_t127 + 0x10));
				_v180 = 0;
				E004B31B8(L"Helper process PID: %u", _t127, 0,  &_v184, _t142, 0x50cc60);
				_pop(_t140);
				 *[fs:eax] = _t140;
				_push(E004B3C91);
				return CloseHandle(_v24);
			}

0x004b39e5
0x004b39e7
0x004b39f2
0x004b39f8
0x004b39fe
0x004b3a01
0x004b3a08
0x004b3a0d
0x004b3a0e
0x004b3a13
0x004b3a16
0x004b3a1e
0x004b3a23
0x004b3a2b
0x004b3a32
0x004b3a32
0x004b3a3e
0x004b3a45
0x004b3a45
0x004b3a4a
0x004b3a4a
0x004b3a51
0x004b3a5c
0x004b3a5f
0x004b3a5f
0x004b3a6d
0x004b3a73
0x004b3a7c
0x004b3a82
0x004b3a8c
0x004b3a92
0x004b3a99
0x004b3a9c
0x004b3aa2
0x004b3aa5
0x004b3ab9
0x004b3ae3
0x004b3aea
0x00000000
0x00000000
0x004b3af6
0x004b3b01
0x004b3b01
0x004b3af6
0x004b3b0d
0x004b3b0e
0x004b3b13
0x004b3b16
0x004b3b39
0x004b3b40
0x004b3b47
0x004b3b47
0x004b3b4e
0x004b3b4f
0x004b3b54
0x004b3b57
0x004b3b5a
0x004b3b74
0x004b3b7b
0x004b3b7b
0x004b3b8a
0x004b3b8f
0x004b3ba4
0x004b3baf
0x004b3bc9
0x004b3bd3
0x004b3bdd
0x004b3be3
0x004b3bfa
0x004b3c05
0x004b3c0b
0x004b3c1d
0x004b3c24
0x004b3c24
0x004b3c29
0x004b3c2d
0x004b3c34
0x004b3c3a
0x004b3c40
0x004b3c45
0x004b3c4c
0x004b3c54
0x004b3c5a
0x004b3c6e
0x004b3c75
0x004b3c78
0x004b3c7b
0x004b3c89

APIs

GetTickCount.KERNEL32(00000000,004B3CDF,?,?,00000000,00000000,?,004B46DE,?,00000000,00000000), ref: 004B3A4C
QueryPerformanceCounter.KERNEL32(00000000,00000000,004B3CDF,?,?,00000000,00000000,?,004B46DE,?,00000000,00000000), ref: 004B3A55
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 004B3A5F
GetCurrentProcessId.KERNEL32(?,00000000,00000000,004B3CDF,?,?,00000000,00000000,?,004B46DE,?,00000000,00000000), ref: 004B3A68
CreateNamedPipeW.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 004B3ADE
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 004B3AEC
CreateFileW.KERNEL32(00000000,C0000000,00000000,00505380,00000003,00000000,00000000,00000000,004B3C9B,?,00000000,40080003,00000006,00000001,00002000,00002000), ref: 004B3B34
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,004B3C8A,?,00000000,C0000000,00000000,00505380,00000003,00000000,00000000,00000000,004B3C9B), ref: 004B3B6D

Part of subcall function 0047F7D8: GetSystemDirectoryW.KERNEL32(?,00000104,?,004FF876,00000000,004FFA91,?,?,00000005,00000000,004FFACA,?,?,00000000,?), ref: 0047F7EB

CreateProcessW.KERNEL32(00000000,00000000,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004B3C16
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 004B3C4C
CloseHandle.KERNEL32(000000FF,004B3C91,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004B3C84

Part of subcall function 004ADFA0: GetLastError.KERNEL32(00000000,004AEC5A,00000005,00000000,004AEC82,?,?,00000000,0050C17C,00000000,00000000,00000000,?,004FFFA7,00000000,004FFFC2), ref: 004ADFA3

Strings

CreateProcess, xrefs: 004B3C1F
helper %d 0x%x, xrefs: 004B3BF5
i, xrefs: 004B3BC9
SetNamedPipeHandleState, xrefs: 004B3B76
CreateNamedPipe, xrefs: 004B3AFC
Helper process PID: %u, xrefs: 004B3C69
64-bit helper EXE wasn't extracted, xrefs: 004B3A40
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 004B3AB4
Starting 64-bit helper process., xrefs: 004B3A19
Cannot utilize 64-bit features on this version of Windows, xrefs: 004B3A2D
D, xrefs: 004B3B8F
CreateFile, xrefs: 004B3B42

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: a479325e7bd2e1a818a1f57ce264b8da830b902f1814ef7a0d1ba0a6c4a30d54
Instruction ID: eeaf975eb4b6442f68a34f623f4a779408e4d9c720d0d20ff70235658a82ea0d
Opcode Fuzzy Hash: a479325e7bd2e1a818a1f57ce264b8da830b902f1814ef7a0d1ba0a6c4a30d54
Instruction Fuzzy Hash: BC715670E003149EDB10DF6ACC41B9EBBF8AB09704F5145AAF508FB282D7789E408B79

Uniqueness

Uniqueness Score: -1.00%

Function 00408174, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 152
stringlibraryfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00408174(WCHAR* __eax, int __edx) {
				WCHAR* _v8;
				int _v12;
				WCHAR* _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v612;
				short _v1134;
				signed int _t53;
				signed int _t54;
				signed int _t59;
				signed int _t60;
				signed int _t105;
				signed int _t106;
				intOrPtr* _t107;
				WCHAR* _t114;
				WCHAR* _t116;
				short* _t117;
				void* _t118;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_v20 = GetModuleHandleW(L"kernel32.dll");
				if(_v20 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t116 =  &(_v8[2]);
						goto L10;
					} else {
						if(_v8[1] == 0x5c) {
							_t117 = E00408150( &(_v8[2]));
							if( *_t117 != 0) {
								_t17 = _t117 + 2; // 0x2
								_t116 = E00408150(_t17);
								if( *_t116 != 0) {
									L10:
									_t105 = _t116 - _v8;
									_t106 = _t105 >> 1;
									if(_t105 < 0) {
										asm("adc ebx, 0x0");
									}
									lstrcpynW( &_v1134, _v8, _t106 + 1);
									while( *_t116 != 0) {
										_t114 = E00408150( &(_t116[1]));
										_t53 = _t114 - _t116;
										_t54 = _t53 >> 1;
										if(_t53 < 0) {
											asm("adc eax, 0x0");
										}
										if(_t54 + _t106 + 1 <= 0x105) {
											_t59 = _t114 - _t116;
											_t60 = _t59 >> 1;
											if(_t59 < 0) {
												asm("adc eax, 0x0");
											}
											lstrcpynW( &_v1134 + _t106 + _t106, _t116, _t60 + 1);
											_v20 = FindFirstFileW( &_v1134,  &_v612);
											if(_v20 != 0xffffffff) {
												FindClose(_v20);
												if(lstrlenW( &(_v612.cFileName)) + _t106 + 1 + 1 <= 0x105) {
													 *((short*)(_t118 + _t106 * 2 - 0x46a)) = 0x5c;
													lstrcpynW( &(( &_v1134 + _t106 + _t106)[1]),  &(_v612.cFileName), 0x105 - _t106 - 1);
													_t106 = _t106 + lstrlenW( &(_v612.cFileName)) + 1;
													_t116 = _t114;
													continue;
												}
											}
										}
										goto L23;
									}
									lstrcpynW(_v8,  &_v1134, _v12);
								}
							}
						}
					}
				} else {
					_t107 = GetProcAddress(_v20, "GetLongPathNameW");
					if(_t107 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v1134);
						_push(_v8);
						if( *_t107() == 0) {
							goto L4;
						} else {
							lstrcpynW(_v8,  &_v1134, _v12);
						}
					}
				}
				L23:
				return _v16;
			}

0x00408180
0x00408183
0x00408189
0x00408196
0x0040819d
0x004081e2
0x004081e9
0x00408229
0x00000000
0x004081eb
0x004081f3
0x00408204
0x0040820a
0x00408210
0x00408218
0x0040821e
0x0040822c
0x0040822e
0x00408231
0x00408233
0x00408235
0x00408235
0x00408247
0x00408316
0x00408259
0x0040825d
0x0040825f
0x00408261
0x00408263
0x00408263
0x0040826e
0x00408276
0x00408278
0x0040827a
0x0040827c
0x0040827c
0x0040828f
0x004082a7
0x004082ae
0x004082b8
0x004082d4
0x004082d6
0x00408300
0x00408312
0x00408314
0x00000000
0x00408314
0x004082d4
0x004082ae
0x00000000
0x0040826e
0x0040832f
0x0040832f
0x0040821e
0x0040820a
0x004081f3
0x0040819f
0x004081ad
0x004081b1
0x00000000
0x004081b3
0x004081b3
0x004081be
0x004081c2
0x004081c7
0x00000000
0x004081c9
0x004081d8
0x004081d8
0x004081c7
0x004081b1
0x00408334
0x0040833d

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0040B384,?,00000000), ref: 00408191
GetProcAddress.KERNEL32(?,GetLongPathNameW,kernel32.dll,0040B384,?,00000000), ref: 004081A8
lstrcpynW.KERNEL32(?,?,?), ref: 004081D8
lstrcpynW.KERNEL32(?,?,?,kernel32.dll,0040B384,?,00000000), ref: 00408247
lstrcpynW.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,0040B384,?,00000000), ref: 0040828F
FindFirstFileW.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,0040B384,?,00000000), ref: 004082A2
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,0040B384,?,00000000), ref: 004082B8
lstrlenW.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,0040B384,?,00000000), ref: 004082C4
lstrcpynW.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,0040B384,?), ref: 00408300
lstrlenW.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,0040B384), ref: 0040830C
lstrcpynW.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 0040832F

Strings

GetLongPathNameW, xrefs: 0040819F
\, xrefs: 004082D6
kernel32.dll, xrefs: 0040818C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 3245196872-3908791685
Opcode ID: d23ac2dccd6c5904ed4ebb122041d1f5d384be88246b7f3bb0063985ae1c4c9b
Instruction ID: 250bcaa9846f6036ca752eb7000dfcf737f83f99ccb7def8f15fd4b0e8f234fa
Opcode Fuzzy Hash: d23ac2dccd6c5904ed4ebb122041d1f5d384be88246b7f3bb0063985ae1c4c9b
Instruction Fuzzy Hash: A3519472E005189BDB10EBE4CD85ADE73BCAF44310F1445BEA944F7290EB789E41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004DA4C8, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E004DA4C8(void* __eax, void* __ebx, DWORD* __ecx, void* __edx, void* __esi, void* __eflags, void* __fp0) {
				char _v8;
				char _v12;
				DWORD* _v16;
				struct _SHELLEXECUTEINFOW _v76;
				long _t41;
				intOrPtr _t69;
				void* _t71;
				void* _t73;
				void* _t74;
				intOrPtr _t75;

				_t73 = _t74;
				_t75 = _t74 + 0xffffffb8;
				_v8 = 0;
				_v12 = 0;
				_v16 = __ecx;
				_t71 = __edx;
				_t60 = __eax;
				_push(_t73);
				_push(0x4da617);
				 *[fs:eax] = _t75;
				E004DA2E4(__eax, __ecx,  &_v8,  *[fs:eax]);
				E004DA3F4( &_v12, _t60, _t71);
				E00403540( &_v76, 0x3c);
				_v76.cbSize = 0x3c;
				_v76.fMask = 0x800540;
				_v76.lpVerb = L"runas";
				_v76.lpFile = E004064D4(_v8);
				_v76.lpParameters = E004064D4(_t71);
				_v76.lpDirectory = E004064D4(_v12);
				_v76.nShow = 1;
				if(ShellExecuteExW( &_v76) == 0) {
					if(GetLastError() == 0x4c7) {
						E0041198C();
					}
					E004ADFA0(L"ShellExecuteEx");
				}
				if(_v76.hProcess == 0) {
					E004ADE4C(L"ShellExecuteEx returned hProcess=0", _t60);
				}
				_push(_t73);
				_push(0x4da5f5);
				_push( *[fs:edx]);
				 *[fs:edx] = _t75;
				do {
					E004D9FF0();
					_t41 = MsgWaitForMultipleObjects(1,  &(_v76.hProcess), 0, 0xffffffff, 0xff);
				} while (_t41 == 1);
				if(_t41 == 0xffffffff) {
					E004ADFA0(L"MsgWaitForMultipleObjects");
				}
				E004D9FF0();
				if(GetExitCodeProcess(_v76.hProcess, _v16) == 0) {
					E004ADFA0(L"GetExitCodeProcess");
				}
				_pop(_t69);
				 *[fs:eax] = _t69;
				_push(E004DA5FC);
				return CloseHandle(_v76.hProcess);
			}

0x004da4c9
0x004da4cb
0x004da4d2
0x004da4d5
0x004da4d8
0x004da4db
0x004da4dd
0x004da4e1
0x004da4e2
0x004da4ea
0x004da4f2
0x004da4fa
0x004da509
0x004da50e
0x004da515
0x004da521
0x004da52c
0x004da536
0x004da541
0x004da544
0x004da556
0x004da562
0x004da564
0x004da564
0x004da56e
0x004da56e
0x004da577
0x004da57e
0x004da57e
0x004da585
0x004da586
0x004da58b
0x004da58e
0x004da591
0x004da591
0x004da5a5
0x004da5aa
0x004da5b2
0x004da5b9
0x004da5b9
0x004da5be
0x004da5d2
0x004da5d9
0x004da5d9
0x004da5e0
0x004da5e3
0x004da5e6
0x004da5f4

APIs

Part of subcall function 004DA2E4: GetModuleHandleW.KERNEL32(kernel32.dll,GetFinalPathNameByHandleW), ref: 004DA310
Part of subcall function 004DA2E4: GetFileAttributesW.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 004DA329
Part of subcall function 004DA2E4: CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 004DA353
Part of subcall function 004DA2E4: CloseHandle.KERNEL32(00000000), ref: 004DA371

Part of subcall function 004DA3F4: GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,004DA487,?,00000000,00000000,?,004DA4FF,00000000,004DA617,?,?,?), ref: 004DA423

ShellExecuteExW.SHELL32(0000003C,00000000,004DA617,?,?,?), ref: 004DA54F
GetLastError.KERNEL32(0000003C,00000000,004DA617,?,?,?), ref: 004DA558
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF,00000000,004DA5F5,?,0000003C,00000000,004DA617,?,?,?), ref: 004DA5A5
GetExitCodeProcess.KERNEL32(00000000,?,00000001,00000000,00000000,000000FF,000000FF,00000000,004DA5F5,?,0000003C,00000000,004DA617,?,?,?), ref: 004DA5CB
CloseHandle.KERNEL32(00000000,004DA5FC,00000000,00000000,000000FF,000000FF,00000000,004DA5F5,?,0000003C,00000000,004DA617,?,?,?), ref: 004DA5EF

Strings

MsgWaitForMultipleObjects, xrefs: 004DA5B4
runas, xrefs: 004DA51C
<, xrefs: 004DA50E
GetExitCodeProcess, xrefs: 004DA5D4
ShellExecuteEx returned hProcess=0, xrefs: 004DA579
ShellExecuteEx, xrefs: 004DA569

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Handle$CloseFile$AttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 254331816-221126205
Opcode ID: 281ae500e0ff37ffcf3c8e599b3b46eb0e2c9544155c4d9cf413e497fc01142a
Instruction ID: c6aa0c6cf13bc106666012c985a96879e5152cb7a0789dabd76d0eb2b0ec5ff2
Opcode Fuzzy Hash: 281ae500e0ff37ffcf3c8e599b3b46eb0e2c9544155c4d9cf413e497fc01142a
Instruction Fuzzy Hash: 3B316370D00208AFDB10EFA6D861A9EB6A8EF08314F54447BF514E7391D73C8954CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00463E60, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00463E60(void* __eax) {
				void* _v28;
				struct _WINDOWPLACEMENT _v56;
				struct tagRECT _v72;
				long _v76;
				long _t70;
				void* _t74;
				struct HWND__* _t77;
				struct tagPOINT* _t79;

				_t79 =  &(_v72.top);
				_t74 = __eax;
				if(IsIconic( *(__eax + 0x24c)) == 0) {
					GetWindowRect( *(_t74 + 0x24c),  &_v72);
				} else {
					_v56.length = 0x2c;
					GetWindowPlacement( *(_t74 + 0x24c),  &_v56);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
				}
				if((GetWindowLongW( *(_t74 + 0x24c), 0xfffffff0) & 0x40000000) != 0) {
					_t77 = GetWindowLongW( *(_t74 + 0x24c), 0xfffffff8);
					if(_t77 != 0) {
						if((GetWindowLongW(_t77, 0xffffffec) & 0x00400000) != 0) {
							_t70 = _v72.left;
							_t79->x = _t70;
							_v72.left = _v72.right;
							_v72.right = _t70;
						}
						_t79->x = _v72.left;
						_v76 = _v72.top.x;
						ScreenToClient(_t77, _t79);
						_v72.left = _t79->x;
						_v72.top.x = _v76;
						_t79->x = _v72.right;
						_v76 = _v72.bottom;
						ScreenToClient(_t77, _t79);
						_v72.right = _t79->x;
						_v72.bottom = _v76;
					}
				}
				 *(_t74 + 0x40) = _v72.left;
				 *(_t74 + 0x44) = _v72.top.x;
				 *((intOrPtr*)(_t74 + 0x48)) = _v72.right - _v72.left;
				 *((intOrPtr*)(_t74 + 0x4c)) = _v72.bottom - _v72.top.x;
				return E0045A604(_t74);
			}

0x00463e63
0x00463e66
0x00463e76
0x00463eab
0x00463e78
0x00463e78
0x00463e8c
0x00463e99
0x00463e9a
0x00463e9b
0x00463e9c
0x00463e9c
0x00463ec3
0x00463ed7
0x00463edb
0x00463eea
0x00463eec
0x00463ef0
0x00463ef7
0x00463efb
0x00463efb
0x00463f03
0x00463f0a
0x00463f10
0x00463f18
0x00463f20
0x00463f28
0x00463f2f
0x00463f35
0x00463f3d
0x00463f45
0x00463f45
0x00463edb
0x00463f4d
0x00463f54
0x00463f5f
0x00463f6a
0x00463f7a

APIs

IsIconic.USER32(?), ref: 00463E6F
GetWindowPlacement.USER32(?,?,?), ref: 00463E8C
GetWindowRect.USER32(?,?,?), ref: 00463EAB
GetWindowLongW.USER32(?,000000F0,?,?,?), ref: 00463EB9
GetWindowLongW.USER32(?,000000F8,?,000000F0,?,?,?), ref: 00463ED2
GetWindowLongW.USER32(00000000,000000EC,?,000000F8,?,000000F0,?,?,?), ref: 00463EE0
ScreenToClient.USER32(00000000,?,00000000,000000EC,?,000000F8,?,000000F0,?,?,?), ref: 00463F10
ScreenToClient.USER32(00000000,?,00000000,?,00000000,000000EC,?,000000F8,?,000000F0,?,?,?), ref: 00463F35

Strings

,, xrefs: 00463E78

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$ClientScreen$IconicPlacementRect
String ID: ,
API String ID: 1823113212-3772416878
Opcode ID: 0aafe5e6025aeae2d1f49fb047a0b22b3c75231a3c2e4c846c65f03920f00c52
Instruction ID: a6e0c8942839327a213a7a05d6a9d8745fb73999251fc647ef4560b66ba5ab70
Opcode Fuzzy Hash: 0aafe5e6025aeae2d1f49fb047a0b22b3c75231a3c2e4c846c65f03920f00c52
Instruction Fuzzy Hash: 4C31C4B5509301AFC740DF6DC584A4BBBE4AF88350F10892EB998D7392E334DD448BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00453668, Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 415
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00453668(intOrPtr __eax, void* __ebx, int* __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				struct HMENU__* _v12;
				signed int _v16;
				signed int _v17;
				intOrPtr _v24;
				int _v28;
				struct HDC__* _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr* _v56;
				char _v60;
				intOrPtr _t148;
				signed int _t149;
				signed int _t162;
				signed int _t163;
				intOrPtr* _t165;
				void* _t170;
				struct HMENU__* _t172;
				intOrPtr* _t177;
				void* _t185;
				signed int _t189;
				signed int _t193;
				void* _t194;
				void* _t226;
				void* _t268;
				signed int _t274;
				void* _t282;
				signed int _t288;
				signed int _t289;
				signed int _t291;
				signed int _t292;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				signed int _t298;
				signed int _t300;
				signed int _t301;
				signed int _t303;
				signed int _t304;
				signed int _t307;
				signed int _t308;
				intOrPtr _t328;
				intOrPtr _t350;
				intOrPtr _t361;
				intOrPtr _t365;
				intOrPtr* _t372;
				signed int _t374;
				intOrPtr* _t375;
				signed int _t386;
				signed int _t387;
				signed int _t388;
				signed int _t389;
				signed int _t390;
				signed int _t391;
				signed int _t392;
				int* _t394;
				void* _t396;
				void* _t397;
				intOrPtr _t398;
				void* _t399;

				_t396 = _t397;
				_t398 = _t397 + 0xffffffc8;
				_v60 = 0;
				_t394 = __edx;
				_v8 = __eax;
				_push(_t396);
				_push(0x453bba);
				_push( *[fs:eax]);
				 *[fs:eax] = _t398;
				_t148 =  *((intOrPtr*)(__edx));
				_t399 = _t148 - 0x111;
				if(_t399 > 0) {
					_t149 = _t148 - 0x117;
					__eflags = _t149;
					if(_t149 == 0) {
						_t288 =  *((intOrPtr*)(_v8 + 8)) - 1;
						__eflags = _t288;
						if(_t288 < 0) {
							goto L67;
						} else {
							_t289 = _t288 + 1;
							_t386 = 0;
							__eflags = 0;
							while(1) {
								_t162 = E0045269C(E00423584(_v8, _t386), _t394[1], __eflags);
								__eflags = _t162;
								if(_t162 != 0) {
									goto L68;
								}
								_t386 = _t386 + 1;
								_t289 = _t289 - 1;
								__eflags = _t289;
								if(_t289 != 0) {
									continue;
								} else {
									goto L67;
								}
								goto L68;
							}
						}
					} else {
						_t163 = _t149 - 8;
						__eflags = _t163;
						if(_t163 == 0) {
							_v17 = 0;
							__eflags =  *(__edx + 6) & 0x00000010;
							if(( *(__edx + 6) & 0x00000010) != 0) {
								_v17 = 1;
							}
							_t291 =  *((intOrPtr*)(_v8 + 8)) - 1;
							__eflags = _t291;
							if(__eflags < 0) {
								L32:
								_t165 =  *0x505e5c; // 0x50c17c
								E0047D22C( *_t165, 0, __eflags);
								goto L67;
							} else {
								_t292 = _t291 + 1;
								_t387 = 0;
								__eflags = 0;
								while(1) {
									__eflags = _v17 - 1;
									if(_v17 != 1) {
										_v12 = _t394[1] & 0x0000ffff;
									} else {
										_t172 = _t394[2];
										__eflags = _t172;
										if(_t172 == 0) {
											_v12 = 0xffffffff;
										} else {
											_v12 = GetSubMenu(_t172, _t394[1] & 0x0000ffff);
										}
									}
									_t170 = E00423584(_v8, _t387);
									_t312 = _v17 & 0x000000ff;
									_v16 = E004525E0(_t170, _v17 & 0x000000ff, _v12);
									__eflags = _v16;
									if(__eflags != 0) {
										break;
									}
									_t387 = _t387 + 1;
									_t292 = _t292 - 1;
									__eflags = _t292;
									if(__eflags != 0) {
										continue;
									} else {
										goto L32;
									}
									goto L68;
								}
								E00457CE0( *((intOrPtr*)(_v16 + 0x54)), _t312,  &_v60, __eflags);
								_t177 =  *0x505e5c; // 0x50c17c
								E0047D22C( *_t177, _v60, __eflags);
							}
						} else {
							__eflags = _t163 == 1;
							if(_t163 == 1) {
								_t294 =  *((intOrPtr*)(_v8 + 8)) - 1;
								__eflags = _t294;
								if(_t294 < 0) {
									goto L67;
								} else {
									_t295 = _t294 + 1;
									_t388 = 0;
									__eflags = 0;
									while(1) {
										_v56 = E00423584(_v8, _t388);
										_t185 =  *((intOrPtr*)( *_v56 + 0x34))();
										__eflags = _t185 - _t394[2];
										if(_t185 == _t394[2]) {
											break;
										}
										_t189 = E004525E0(_v56, 1, _t394[2]);
										__eflags = _t189;
										if(_t189 == 0) {
											_t388 = _t388 + 1;
											_t295 = _t295 - 1;
											__eflags = _t295;
											if(_t295 != 0) {
												continue;
											} else {
												goto L67;
											}
										} else {
											break;
										}
										goto L68;
									}
									E00453244(_v56, _t394);
								}
							} else {
								goto L67;
							}
						}
					}
					goto L68;
				} else {
					if(_t399 == 0) {
						_t297 =  *((intOrPtr*)(_v8 + 8)) - 1;
						__eflags = _t297;
						if(_t297 < 0) {
							goto L67;
						} else {
							_t298 = _t297 + 1;
							_t389 = 0;
							__eflags = 0;
							while(1) {
								E00423584(_v8, _t389);
								_t193 = E00452680(_t394[1] & 0x0000ffff, __eflags);
								__eflags = _t193;
								if(_t193 != 0) {
									goto L68;
								}
								_t389 = _t389 + 1;
								_t298 = _t298 - 1;
								__eflags = _t298;
								if(_t298 != 0) {
									continue;
								} else {
									goto L67;
								}
								goto L68;
							}
						}
						goto L68;
					} else {
						_t194 = _t148 - 0x2b;
						if(_t194 == 0) {
							_v48 =  *((intOrPtr*)(__edx + 8));
							_t300 =  *((intOrPtr*)(_v8 + 8)) - 1;
							__eflags = _t300;
							if(_t300 < 0) {
								goto L67;
							} else {
								_t301 = _t300 + 1;
								_t390 = 0;
								__eflags = 0;
								while(1) {
									_v16 = E004525E0(E00423584(_v8, _t390), 0,  *((intOrPtr*)(_v48 + 8)));
									__eflags = _v16;
									if(_v16 != 0) {
										break;
									}
									_t390 = _t390 + 1;
									_t301 = _t301 - 1;
									__eflags = _t301;
									if(_t301 != 0) {
										continue;
									} else {
										goto L67;
									}
									goto L69;
								}
								_v24 = E004318E0(0, 1);
								_push(_t396);
								_push(0x4539cf);
								_push( *[fs:eax]);
								 *[fs:eax] = _t398;
								_v28 = SaveDC( *(_v48 + 0x18));
								_push(_t396);
								_push(0x4539b2);
								_push( *[fs:eax]);
								 *[fs:eax] = _t398;
								E00432674(_v24,  *(_v48 + 0x18));
								E00432508(_v24);
								E00453E80(_v16, _v48 + 0x1c, _v24,  *(_v48 + 0x10) & 0x0000ffff);
								_pop(_t350);
								 *[fs:eax] = _t350;
								_push(0x4539b9);
								__eflags = 0;
								E00432674(_v24, 0);
								return RestoreDC( *(_v48 + 0x18), _v28);
							}
						} else {
							_t226 = _t194 - 1;
							if(_t226 == 0) {
								_v52 =  *((intOrPtr*)(__edx + 8));
								_t303 =  *((intOrPtr*)(_v8 + 8)) - 1;
								__eflags = _t303;
								if(_t303 < 0) {
									goto L67;
								} else {
									_t304 = _t303 + 1;
									_t391 = 0;
									__eflags = 0;
									while(1) {
										_v16 = E004525E0(E00423584(_v8, _t391), 0,  *((intOrPtr*)(_v52 + 8)));
										__eflags = _v16;
										if(_v16 != 0) {
											break;
										}
										_t391 = _t391 + 1;
										_t304 = _t304 - 1;
										__eflags = _t304;
										if(_t304 != 0) {
											continue;
										} else {
											goto L67;
										}
										goto L69;
									}
									_v32 = GetWindowDC( *(_v8 + 0x10));
									 *[fs:eax] = _t398;
									_v24 = E004318E0(0, 1);
									 *[fs:eax] = _t398;
									_v28 = SaveDC(_v32);
									 *[fs:eax] = _t398;
									E00432674(_v24, _v32);
									E00432508(_v24);
									_v36 =  *((intOrPtr*)(_v52 + 0xc));
									_v40 =  *((intOrPtr*)(_v52 + 0x10));
									 *((intOrPtr*)( *_v16 + 0x38))( &_v40,  *[fs:eax], 0x453aee, _t396,  *[fs:eax], 0x453b0b, _t396,  *[fs:eax], 0x453b30, _t396);
									 *((intOrPtr*)(_v52 + 0xc)) = _v36;
									 *((intOrPtr*)(_v52 + 0x10)) = _v40;
									_pop(_t361);
									 *[fs:eax] = _t361;
									_push(0x453af5);
									__eflags = 0;
									E00432674(_v24, 0);
									return RestoreDC(_v32, _v28);
								}
							} else {
								if(_t226 == 0x27) {
									_v44 =  *((intOrPtr*)(__edx + 8));
									_t307 =  *((intOrPtr*)(_v8 + 8)) - 1;
									__eflags = _t307;
									if(_t307 < 0) {
										goto L67;
									} else {
										_t308 = _t307 + 1;
										_t392 = 0;
										__eflags = 0;
										while(1) {
											_t268 =  *((intOrPtr*)( *((intOrPtr*)(E00423584(_v8, _t392))) + 0x34))();
											_t365 = _v44;
											__eflags = _t268 -  *((intOrPtr*)(_t365 + 0xc));
											if(_t268 !=  *((intOrPtr*)(_t365 + 0xc))) {
												_v16 = E004525E0(E00423584(_v8, _t392), 1,  *((intOrPtr*)(_v44 + 0xc)));
											} else {
												_v16 =  *((intOrPtr*)(E00423584(_v8, _t392) + 0x34));
											}
											__eflags = _v16;
											if(_v16 != 0) {
												break;
											}
											_t392 = _t392 + 1;
											_t308 = _t308 - 1;
											__eflags = _t308;
											if(_t308 != 0) {
												continue;
											} else {
												goto L67;
											}
											goto L68;
										}
										_t274 = E00452610(E00423584(_v8, _t392), 1,  *((intOrPtr*)(_v44 + 8)));
										__eflags = _t274;
										if(_t274 == 0) {
											_t282 = E00423584(_v8, _t392);
											__eflags = 0;
											_t274 = E00452610(_t282, 0,  *((intOrPtr*)(_v44 + 0xc)));
										}
										_t372 =  *0x506040; // 0x50c180
										_t374 =  *( *_t372 + 0x64);
										__eflags = _t374;
										if(_t374 != 0) {
											__eflags = _t274;
											if(_t274 == 0) {
												_t274 =  *(_t374 + 0x160);
											}
											__eflags =  *(_t374 + 0x280) & 0x00000008;
											if(( *(_t374 + 0x280) & 0x00000008) == 0) {
												_t375 =  *0x505e5c; // 0x50c17c
												E0047CE28( *_t375, _t308, _t274, _t392, _t394);
											} else {
												E0047CEB0();
											}
										}
									}
								} else {
									L67:
									_t394[3] = DefWindowProcW( *(_v8 + 0x10),  *_t394, _t394[1], _t394[2]);
								}
								L68:
								_pop(_t328);
								 *[fs:eax] = _t328;
								_push(0x453bc1);
								return L00406438( &_v60);
							}
						}
					}
				}
				L69:
			}

0x00453669
0x0045366b
0x00453673
0x00453676
0x00453678
0x0045367d
0x0045367e
0x00453683
0x00453686
0x00453689
0x0045368b
0x00453690
0x004536b2
0x004536b2
0x004536b7
0x00453706
0x00453707
0x00453709
0x00000000
0x0045370f
0x0045370f
0x00453710
0x00453710
0x00453712
0x0045371f
0x00453724
0x00453726
0x00000000
0x00000000
0x0045372c
0x0045372d
0x0045372d
0x0045372e
0x00000000
0x00453730
0x00000000
0x00453730
0x00000000
0x0045372e
0x00453712
0x004536b9
0x004536b9
0x004536b9
0x004536bc
0x00453735
0x00453739
0x0045373d
0x0045373f
0x0045373f
0x00453749
0x0045374a
0x0045374c
0x004537c3
0x004537c3
0x004537cc
0x00000000
0x0045374e
0x0045374e
0x0045374f
0x0045374f
0x00453751
0x00453751
0x00453755
0x0045377b
0x00453757
0x00453757
0x0045375a
0x0045375c
0x0045376e
0x0045375e
0x00453769
0x00453769
0x0045375c
0x00453783
0x00453788
0x00453794
0x00453797
0x0045379b
0x00000000
0x00000000
0x004537bf
0x004537c0
0x004537c0
0x004537c1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004537c1
0x004537a6
0x004537ae
0x004537b5
0x004537b5
0x004536be
0x004536be
0x004536bf
0x00453b47
0x00453b48
0x00453b4a
0x00000000
0x00453b4c
0x00453b4c
0x00453b4d
0x00453b4d
0x00453b4f
0x00453b59
0x00453b61
0x00453b64
0x00453b67
0x00000000
0x00000000
0x00453b71
0x00453b76
0x00453b78
0x00453b86
0x00453b87
0x00453b87
0x00453b88
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00453b78
0x00453b7f
0x00453b7f
0x004536c5
0x00000000
0x004536c5
0x004536bf
0x004536bc
0x00000000
0x00453692
0x00453692
0x004536d0
0x004536d1
0x004536d3
0x00000000
0x004536d9
0x004536d9
0x004536da
0x004536da
0x004536dc
0x004536e1
0x004536ea
0x004536ef
0x004536f1
0x00000000
0x00000000
0x004536f7
0x004536f8
0x004536f8
0x004536f9
0x00000000
0x004536fb
0x00000000
0x004536fb
0x00000000
0x004536f9
0x004536dc
0x00000000
0x00453694
0x00453694
0x00453697
0x004538db
0x004538e4
0x004538e5
0x004538e7
0x00000000
0x004538ed
0x004538ed
0x004538ee
0x004538ee
0x004538f0
0x00453907
0x0045390a
0x0045390e
0x00000000
0x00000000
0x004539d6
0x004539d7
0x004539d7
0x004539d8
0x00000000
0x004539de
0x00000000
0x004539de
0x00000000
0x004539d8
0x00453920
0x00453925
0x00453926
0x0045392b
0x0045392e
0x0045393d
0x00453942
0x00453943
0x00453948
0x0045394b
0x00453957
0x0045396c
0x00453985
0x0045398c
0x0045398f
0x00453992
0x00453997
0x0045399c
0x004539b1
0x004539b1
0x0045369d
0x0045369d
0x0045369e
0x004539e6
0x004539ef
0x004539f0
0x004539f2
0x00000000
0x004539f8
0x004539f8
0x004539f9
0x004539f9
0x004539fb
0x00453a12
0x00453a15
0x00453a19
0x00000000
0x00000000
0x00453b37
0x00453b38
0x00453b38
0x00453b39
0x00000000
0x00453b3f
0x00000000
0x00453b3f
0x00000000
0x00453b39
0x00453a2b
0x00453a39
0x00453a48
0x00453a56
0x00453a62
0x00453a70
0x00453a79
0x00453a8e
0x00453a99
0x00453aa2
0x00453ab4
0x00453abd
0x00453ac6
0x00453acb
0x00453ace
0x00453ad1
0x00453ad6
0x00453adb
0x00453aed
0x00453aed
0x004536a4
0x004536a7
0x004537d9
0x004537e2
0x004537e3
0x004537e5
0x00000000
0x004537eb
0x004537eb
0x004537ec
0x004537ec
0x004537ee
0x004537fa
0x004537fd
0x00453800
0x00453803
0x0045382e
0x00453805
0x00453812
0x00453812
0x00453831
0x00453835
0x00000000
0x00000000
0x004538cb
0x004538cc
0x004538cc
0x004538cd
0x00000000
0x004538d3
0x00000000
0x004538d3
0x00000000
0x004538cd
0x0045384d
0x00453852
0x00453854
0x0045385b
0x00453866
0x00453868
0x00453868
0x0045386d
0x00453875
0x00453878
0x0045387a
0x00453880
0x00453882
0x00453889
0x00453889
0x00453895
0x0045389c
0x004538b8
0x004538c1
0x0045389e
0x004538ae
0x004538ae
0x0045389c
0x0045387a
0x004536ad
0x00453b8a
0x00453ba1
0x00453ba1
0x00453ba4
0x00453ba6
0x00453ba9
0x00453bac
0x00453bb9
0x00453bb9
0x0045369e
0x00453697
0x00453692
0x00000000

APIs

SaveDC.GDI32(?,00000000,004539CF,?,00000000,00453BBA), ref: 00453938
RestoreDC.GDI32(?,?,004539B9,?,?,00000000,004539CF,?,00000000,00453BBA), ref: 004539AC
GetWindowDC.USER32(?,00000000,00453BBA), ref: 00453A26
SaveDC.GDI32(?,00000000,00453B0B,?,00000000,00453B30,?,?,00000000,00453BBA), ref: 00453A5D
RestoreDC.GDI32(?,?,00453AF5,00453B0B,?,00000000,00453B30,?,?,00000000,00453BBA), ref: 00453AE8
DefWindowProcW.USER32(?,?,?,?,00000000,00453BBA), ref: 00453B9C

Strings

@IE, xrefs: 00453916, 00453A3E

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: RestoreSaveWindow$Proc
String ID: @IE
API String ID: 1975259465-2832602497
Opcode ID: 7fc2e50244c120197ae2d9d1a27ca065632524776c5b86b441f01c742df27f7b
Instruction ID: 94d2dd493d345436b2f2d9cc6a6f492b3c886d776c843f0aa1196d06c6798704
Opcode Fuzzy Hash: 7fc2e50244c120197ae2d9d1a27ca065632524776c5b86b441f01c742df27f7b
Instruction Fuzzy Hash: 61F14AB4A006099FCB10DFA9C58199EF7F5FF48346B2185AAEC05A7322D638EE45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004FFC74, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 91fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,004FFDB7,?,00000000,0050C17C,?,004FFF6E,00000000,004FFFC2,?,00000000,00000000,00000000), ref: 004FFCC5
SetFileAttributesW.KERNEL32(00000000,00000010), ref: 004FFD48
DeleteFileW.KERNEL32(00000000), ref: 004FFD56
FindNextFileW.KERNEL32(000000FF,?,00000000,004FFD8A,?,00000000,?,00000000,004FFDB7,?,00000000,0050C17C,?,004FFF6E,00000000,004FFFC2), ref: 004FFD66
FindClose.KERNEL32(000000FF,004FFD91,004FFD8A,?,00000000,?,00000000,004FFDB7,?,00000000,0050C17C,?,004FFF6E,00000000,004FFFC2), ref: 004FFD84

Strings

isRS-, xrefs: 004FFCE5
isRS-???.tmp, xrefs: 004FFCAD

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Find$AttributesCloseDeleteFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 1425421994-3422211394
Opcode ID: da8c400ca64083d711d3501738f63e833eac3e67ed56ffd7a3a8b38048f2b51e
Instruction ID: ec37404704823026911b2dcd90e83dbd156b6ce424b2bb4781e5834daa807586
Opcode Fuzzy Hash: da8c400ca64083d711d3501738f63e833eac3e67ed56ffd7a3a8b38048f2b51e
Instruction Fuzzy Hash: 4F31747190465CAFCB10DB65CC45AEEB7FCEF88304F5145FBA905B3691EB389E448A18

Uniqueness

Uniqueness Score: -1.00%

Function 004B0418, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004B0428
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004B042E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,00000028,00000000,00000028), ref: 004B0447
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004B046E
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004B0473
ExitWindowsEx.USER32(00000002,00000000), ref: 004B0484

Strings

SeShutdownPrivilege, xrefs: 004B0440

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 8f6cd8b8f631b19c6657ebae921a4aef2f5b6571fc7d9b31f32071124e490fa6
Instruction ID: d14edac44ce4632d261e223ae002597de6e88e1e819cbe48c1516af3b2da3925
Opcode Fuzzy Hash: 8f6cd8b8f631b19c6657ebae921a4aef2f5b6571fc7d9b31f32071124e490fa6
Instruction Fuzzy Hash: EAF062706543017AE620AA718C07FAB32C85B41B49F504D3EFB41E91C2E7BDD944863E

Uniqueness

Uniqueness Score: -1.00%

Function 004812D0, Relevance: 9.1, APIs: 6, Instructions: 90windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?,00000000,?), ref: 004812FD
GetWindowLongW.USER32(?,000000F0,?,00000000,?), ref: 00481316
GetWindowLongW.USER32(?,000000EC,?,000000F0,?,00000000,?), ref: 00481332
GetActiveWindow.USER32(?,00000000,?), ref: 0048133B
MessageBoxW.USER32(00000000,00000000,00000000,00000000,00000000,0048138F,?,?,00000000,?), ref: 00481368
SetActiveWindow.USER32(?,004813E4,00000000,00000000,0048138F,?,?,00000000,?), ref: 00481389

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$ActiveLong$IconicMessage
String ID:
API String ID: 1633107849-0
Opcode ID: e35cbec17c4dcc51a4110a7633a6a25ac57d470267689058932d20f829f360a6
Instruction ID: 7a8e2b4a22dbd026dae21145add7a8badfe4f44429c1a8d38062ae134cef611d
Opcode Fuzzy Hash: e35cbec17c4dcc51a4110a7633a6a25ac57d470267689058932d20f829f360a6
Instruction Fuzzy Hash: 48317070A04704AFEB01EBA9C891A9E77ECEB4D304F1148AAF804E77A1D6389D01DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004633F4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00463433
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00463451
GetWindowPlacement.USER32(?,0000002C), ref: 00463487
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 004634AB

Strings

,, xrefs: 00463475

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: a50a1f3179e8ead2b092e14f8d4d96a94e594dc1bdf123d5a35b96ca4d78e546
Instruction ID: fb08ab0b2019bf51383f0a8766e73116dd517715176e9d0eefd97e02c605a235
Opcode Fuzzy Hash: a50a1f3179e8ead2b092e14f8d4d96a94e594dc1bdf123d5a35b96ca4d78e546
Instruction Fuzzy Hash: 732174716002449BCF54DF6DC8C498EB7A8AF04315F008066FE18EF346EB7ADD088BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00480964, Relevance: 7.5, APIs: 5, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,004ADAE4,00000000,004ADB05), ref: 00480986
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000), ref: 004809B0
GetLastError.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000), ref: 004809BD
CloseHandle.KERNEL32(00000000,00000000,0009C040,?,00000002,00000000,00000000,?,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000), ref: 004809C5
SetLastError.KERNEL32(00000000,00000000,00000000,0009C040,?,00000002,00000000,00000000,?,00000000,00000000,C0000000,00000001,00000000,00000003,02000000), ref: 004809CB

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: 5b227cbc9f9ec5a8041526f6c6ab9a07e2a7110a340418db20cf9e259dee74f9
Instruction ID: cfb0733ea61486ef7207773c5d706c0a0db976702a6a9dbb4366cfac7d20e15f
Opcode Fuzzy Hash: 5b227cbc9f9ec5a8041526f6c6ab9a07e2a7110a340418db20cf9e259dee74f9
Instruction Fuzzy Hash: 9CF090B279522039F121727A1C82FBF018C9B85B68F51453BF700FB1C3D5AD9D1A52AD

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC64, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

MonitorFromWindow, xrefs: 0042DC7B

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc
String ID: MonitorFromWindow
API String ID: 190572456-2842599566
Opcode ID: 9c8bf68e6b3b93ca78998b36128df3152dc23f8e7681e4839e35c3741403c3f6
Instruction ID: 41f70921d965c2ef685a8908999ecb96f7a531d3ad6a22640c5b95116a7e7a34
Opcode Fuzzy Hash: 9c8bf68e6b3b93ca78998b36128df3152dc23f8e7681e4839e35c3741403c3f6
Instruction Fuzzy Hash: 75014B71A040286ADB00EB66ED81EEF736CAB15314B944027E91197382E7B89D09D7AD

Uniqueness

Uniqueness Score: -1.00%

Function 0047A598, Relevance: 4.5, APIs: 3, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0047A5A4
GetCursorPos.USER32(?,00000000,00000064), ref: 0047A5C1
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 0047A5E1

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentCursorObjectSingleThreadWait
String ID:
API String ID: 1359611202-0
Opcode ID: 6ae5652cc2fbaae763ae4e211ce6744c73d9571f9335672d3cbc22853ec2141f
Instruction ID: f46214eda9eef4d3167c91bf9a36b027d733acbe74503230a65012637c2bb1c7
Opcode Fuzzy Hash: 6ae5652cc2fbaae763ae4e211ce6744c73d9571f9335672d3cbc22853ec2141f
Instruction Fuzzy Hash: 3AF0B431504304EADB10E7A6D8C6B8E33E8AB56314F404127F5059A2D2EB789C54EB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00462A84, Relevance: 3.1, APIs: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00462ABC
GetCapture.USER32(?), ref: 00462AC5

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: 8f1a8b91e99d6b9a8807505b7b7434188cbb0a9e1e57a737d28936e9acaa7ff9
Instruction ID: 935ede60ef572bd4ea8adbdd246062eaab22b30f6b014246ed8b72c021854b5f
Opcode Fuzzy Hash: 8f1a8b91e99d6b9a8807505b7b7434188cbb0a9e1e57a737d28936e9acaa7ff9
Instruction Fuzzy Hash: 7C111C31600605ABDB24EF9DCAC596AB3E5EB04304B2440AAE804DB396E6FCED44A759

Uniqueness

Uniqueness Score: -1.00%

Function 0043293C, Relevance: 3.0, APIs: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004329D8,?,00000000,?,004329F0,00000000,00434C03,00000000,00000000,00434DA3,?,00000000,00000054,?,00000000), ref: 0043295C
FormatMessageW.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,004329D8,?,00000000,?,004329F0,00000000,00434C03,00000000), ref: 00432982

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: d67aee4dfb9d6bf3155ba0126b95fdce7d601216fa80b3ffe8f74db4e16c7aeb
Instruction ID: ab79f9e7bfba2df67da1cf8acb4a1346e0ac4c27d474ab22e7aae03b0e2eecb0
Opcode Fuzzy Hash: d67aee4dfb9d6bf3155ba0126b95fdce7d601216fa80b3ffe8f74db4e16c7aeb
Instruction Fuzzy Hash: 5A01ACB03043155BE721FB618D92B9A77A8EB0C704F9140B7FA14A61D2DAB8AD40895D

Uniqueness

Uniqueness Score: -1.00%

Function 00480ED0, Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(00000001,00000001), ref: 00480EDD
SetSecurityDescriptorDacl.ADVAPI32(00000000,000000FF,00000000,00000000,00000001,00000001), ref: 00480EED

Part of subcall function 00409458: CreateMutexW.KERNEL32(?,000000ED,000000EC,?,0050006F,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,005003A4,?,?,00000000,?), ref: 0040946E

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: DescriptorSecurity$CreateDaclInitializeMutex
String ID:
API String ID: 3525989157-0
Opcode ID: ac93a9119a5d27a078c99742270b39a0b46fa624568dfc65124e3bd834a325b5
Instruction ID: bfdd17de1d08f15f1eb1e8bd115aa5957c8100b125f9989b3268e9b648247d5b
Opcode Fuzzy Hash: ac93a9119a5d27a078c99742270b39a0b46fa624568dfc65124e3bd834a325b5
Instruction Fuzzy Hash: 18E0E5B1A443006FD700DFB58C42F5A76DC9B84714F11493EB564E62C2E679D90987AA

Uniqueness

Uniqueness Score: -1.00%

Function 004B2BD4, Relevance: 3.0, APIs: 2, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000,0050C17C), ref: 004B2BE1
FileTimeToSystemTime.KERNEL32(00000000,?,00000000,0050C17C), ref: 004B2BF8

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: f397b85e3c0bd1a4792a9e25a4bc76e7f8c74953e2bcc25e537551a79ea9e96e
Instruction ID: e859b261986d4533c5ec2674bd71961ae00baa265bb318ac6fd3ba130df2317e
Opcode Fuzzy Hash: f397b85e3c0bd1a4792a9e25a4bc76e7f8c74953e2bcc25e537551a79ea9e96e
Instruction Fuzzy Hash: 23D05BB240820C6ADF04B2E59C828CE77DCA604224F100677E118E21D3FE35AA41429C

Uniqueness

Uniqueness Score: -1.00%

Function 00470AC4, Relevance: 1.5, APIs: 1, Instructions: 11windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?,00477CF1,00000000,00477D85), ref: 00470AE0

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Iconic
String ID:
API String ID: 110040809-0
Opcode ID: 3680a002f7f62d1cf626b704ecce504810a67bae85dfc64bbb1d941bca4e45de
Instruction ID: 833b63a6ed87f73c7e7717b1fb6362351016bc7d5ed8ee4ff97b41163aab002c
Opcode Fuzzy Hash: 3680a002f7f62d1cf626b704ecce504810a67bae85dfc64bbb1d941bca4e45de
Instruction Fuzzy Hash: 7AC012705101008BCB01E734C49098537767767305FE08796D00486057C378DC499694

Uniqueness

Uniqueness Score: -1.00%

Function 00438A30, Relevance: 86.0, APIs: 1, Strings: 48, Instructions: 268
libraryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00438A30(void* __ebx) {
				char _v5;
				intOrPtr* _t3;
				intOrPtr* _t6;
				void* _t105;
				intOrPtr _t110;
				void* _t112;
				void* _t113;
				intOrPtr _t115;

				_t3 =  *0x50c02c; // 0x22ff568
				 *((intOrPtr*)( *_t3))(__ebx, _t105, _t113);
				_push(_t115);
				_push(0x438de2);
				_push( *[fs:edx]);
				 *[fs:edx] = _t115;
				 *0x50c028 =  *0x50c028 + 1;
				if( *0x50c024 == 0) {
					 *0x50c024 = LoadLibraryW(L"uxtheme.dll");
					if( *0x50c024 > 0) {
						 *0x50bf64 = E00409620(0x50c024, _t112,  *0x50c024, L"OpenThemeData");
						 *0x50bf68 = E00409620(0x50c024, _t112,  *0x50c024, L"CloseThemeData");
						 *0x50bf6c = E00409620(0x50c024, _t112,  *0x50c024, L"DrawThemeBackground");
						 *0x50bf70 = E00409620(0x50c024, _t112,  *0x50c024, L"DrawThemeText");
						 *0x50bf74 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeBackgroundContentRect");
						 *0x50bf78 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeBackgroundExtent");
						 *0x50bf7c = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemePartSize");
						 *0x50bf80 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeTextExtent");
						 *0x50bf84 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeTextMetrics");
						 *0x50bf88 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeBackgroundRegion");
						 *0x50bf8c = E00409620(0x50c024, _t112,  *0x50c024, L"HitTestThemeBackground");
						 *0x50bf90 = E00409620(0x50c024, _t112,  *0x50c024, L"DrawThemeEdge");
						 *0x50bf94 = E00409620(0x50c024, _t112,  *0x50c024, L"DrawThemeIcon");
						 *0x50bf98 = E00409620(0x50c024, _t112,  *0x50c024, L"IsThemePartDefined");
						 *0x50bf9c = E00409620(0x50c024, _t112,  *0x50c024, L"IsThemeBackgroundPartiallyTransparent");
						 *0x50bfa0 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeColor");
						 *0x50bfa4 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeMetric");
						 *0x50bfa8 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeString");
						 *0x50bfac = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeBool");
						 *0x50bfb0 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeInt");
						 *0x50bfb4 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeEnumValue");
						 *0x50bfb8 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemePosition");
						 *0x50bfbc = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeFont");
						 *0x50bfc0 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeRect");
						 *0x50bfc4 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeMargins");
						 *0x50bfc8 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeIntList");
						 *0x50bfcc = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemePropertyOrigin");
						 *0x50bfd0 = E00409620(0x50c024, _t112,  *0x50c024, L"SetWindowTheme");
						 *0x50bfd4 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeFilename");
						 *0x50bfd8 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeSysColor");
						 *0x50bfdc = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeSysColorBrush");
						 *0x50bfe0 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeSysBool");
						 *0x50bfe4 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeSysSize");
						 *0x50bfe8 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeSysFont");
						 *0x50bfec = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeSysString");
						 *0x50bff0 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeSysInt");
						 *0x50bff4 = E00409620(0x50c024, _t112,  *0x50c024, L"IsThemeActive");
						 *0x50bff8 = E00409620(0x50c024, _t112,  *0x50c024, L"IsAppThemed");
						 *0x50bffc = E00409620(0x50c024, _t112,  *0x50c024, L"GetWindowTheme");
						 *0x50c000 = E00409620(0x50c024, _t112,  *0x50c024, L"EnableThemeDialogTexture");
						 *0x50c004 = E00409620(0x50c024, _t112,  *0x50c024, L"IsThemeDialogTextureEnabled");
						 *0x50c008 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeAppProperties");
						 *0x50c00c = E00409620(0x50c024, _t112,  *0x50c024, L"SetThemeAppProperties");
						 *0x50c010 = E00409620(0x50c024, _t112,  *0x50c024, L"GetCurrentThemeName");
						 *0x50c014 = E00409620(0x50c024, _t112,  *0x50c024, L"GetThemeDocumentationProperty");
						 *0x50c018 = E00409620(0x50c024, _t112,  *0x50c024, L"DrawThemeParentBackground");
						 *0x50c01c = E00409620(0x50c024, _t112,  *0x50c024, L"EnableTheming");
					}
				}
				_v5 =  *0x50c024 > 0;
				_pop(_t110);
				 *[fs:eax] = _t110;
				_t6 =  *0x50c02c; // 0x22ff568
				return  *((intOrPtr*)( *_t6 + 4))(0x438de9);
			}

0x00438a3a
0x00438a41
0x00438a45
0x00438a46
0x00438a4b
0x00438a4e
0x00438a51
0x00438a5a
0x00438a6a
0x00438a6f
0x00438a82
0x00438a94
0x00438aa6
0x00438ab8
0x00438aca
0x00438adc
0x00438aee
0x00438b00
0x00438b12
0x00438b24
0x00438b36
0x00438b48
0x00438b5a
0x00438b6c
0x00438b7e
0x00438b90
0x00438ba2
0x00438bb4
0x00438bc6
0x00438bd8
0x00438bea
0x00438bfc
0x00438c0e
0x00438c20
0x00438c32
0x00438c44
0x00438c56
0x00438c68
0x00438c7a
0x00438c8c
0x00438c9e
0x00438cb0
0x00438cc2
0x00438cd4
0x00438ce6
0x00438cf8
0x00438d0a
0x00438d1c
0x00438d2e
0x00438d40
0x00438d52
0x00438d64
0x00438d76
0x00438d88
0x00438d9a
0x00438dac
0x00438dbe
0x00438dbe
0x00438a6f
0x00438dc6
0x00438dcc
0x00438dcf
0x00438dd7
0x00438de1

APIs

LoadLibraryW.KERNEL32(uxtheme.dll,00000000,00438DE2), ref: 00438A65

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,00000000,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409666

Strings

IsAppThemed, xrefs: 00438D0F
GetThemeBackgroundExtent, xrefs: 00438ACF
GetThemeSysColorBrush, xrefs: 00438C91
OpenThemeData, xrefs: 00438A75
EnableTheming, xrefs: 00438DB1
GetThemeAppProperties, xrefs: 00438D57
GetThemeSysSize, xrefs: 00438CB5
IsThemeBackgroundPartiallyTransparent, xrefs: 00438B71
GetThemeRect, xrefs: 00438C13
DrawThemeIcon, xrefs: 00438B4D
GetThemeMargins, xrefs: 00438C25
GetWindowTheme, xrefs: 00438D21
GetThemeTextExtent, xrefs: 00438AF3
GetThemeBool, xrefs: 00438BB9
DrawThemeEdge, xrefs: 00438B3B
GetThemeInt, xrefs: 00438BCB
IsThemePartDefined, xrefs: 00438B5F
IsThemeActive, xrefs: 00438CFD
GetThemeColor, xrefs: 00438B83
GetThemeSysBool, xrefs: 00438CA3
DrawThemeBackground, xrefs: 00438A99
GetThemeEnumValue, xrefs: 00438BDD
GetCurrentThemeName, xrefs: 00438D7B
GetThemeBackgroundRegion, xrefs: 00438B17
GetThemeString, xrefs: 00438BA7
SetThemeAppProperties, xrefs: 00438D69
uxtheme.dll, xrefs: 00438A60
GetThemePartSize, xrefs: 00438AE1
GetThemeBackgroundContentRect, xrefs: 00438ABD
GetThemeSysColor, xrefs: 00438C7F
GetThemeTextMetrics, xrefs: 00438B05
GetThemeFilename, xrefs: 00438C6D
GetThemeSysInt, xrefs: 00438CEB
GetThemeDocumentationProperty, xrefs: 00438D8D
GetThemePosition, xrefs: 00438BEF
DrawThemeText, xrefs: 00438AAB
GetThemeSysFont, xrefs: 00438CC7
GetThemeSysString, xrefs: 00438CD9
EnableThemeDialogTexture, xrefs: 00438D33
DrawThemeParentBackground, xrefs: 00438D9F
SetWindowTheme, xrefs: 00438C5B
GetThemeMetric, xrefs: 00438B95
CloseThemeData, xrefs: 00438A87
GetThemeIntList, xrefs: 00438C37
GetThemeFont, xrefs: 00438C01
IsThemeDialogTextureEnabled, xrefs: 00438D45
HitTestThemeBackground, xrefs: 00438B29
GetThemePropertyOrigin, xrefs: 00438C49

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundExtent$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 2238633743-1748089680
Opcode ID: b74559393543a75b3ab5a3e98ec911a4bd61fbdb0c76bbe00955f68821613e20
Instruction ID: 6787656f7956a8d6e1c63d03467d835770f099ba6b43c228b72967b114b5f1ba
Opcode Fuzzy Hash: b74559393543a75b3ab5a3e98ec911a4bd61fbdb0c76bbe00955f68821613e20
Instruction Fuzzy Hash: 2EA163B0940B11AFEB04EFB5ECC6E2A77A4EB19704B10296BB400DF296D7799C04DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004A5230, Relevance: 84.3, APIs: 1, Strings: 47, Instructions: 280
libraryCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004A5230(void* __ebx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _t121;
				intOrPtr _t128;

				_t125 = __esi;
				_push(0);
				_push(0);
				_push(__ebx);
				_push(_t128);
				_push(0x4a5611);
				_push( *[fs:eax]);
				 *[fs:eax] = _t128;
				 *0x50c2c8 =  *0x50c2c8 + 1;
				if( *0x50c2c4 == 0) {
					E004A51AC();
					if(0 != 0) {
						E004A5200( &_v12);
						E0047E328(_v12,  &_v8);
						E00406854( &_v8, L"uxtheme.dll");
						LoadLibraryW(E004064D4(_v8));
						 *0x50c2c4 = 0;
						if( *0x50c2c4 != 0) {
							 *0x50c208 = E00409620(0x50c2c4, __esi,  *0x50c2c4, L"OpenThemeData");
							 *0x50c20c = E00409620(0x50c2c4, __esi,  *0x50c2c4, L"CloseThemeData");
							 *0x50c210 = E00409620(0x50c2c4, __esi,  *0x50c2c4, L"DrawThemeBackground");
							 *0x50c214 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"DrawThemeText");
							 *0x50c218 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeBackgroundContentRect");
							 *0x50c21c = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeBackgroundContentRect");
							 *0x50c220 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemePartSize");
							 *0x50c224 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeTextExtent");
							 *0x50c228 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeTextMetrics");
							 *0x50c22c = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeBackgroundRegion");
							 *0x50c230 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"HitTestThemeBackground");
							 *0x50c234 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"DrawThemeEdge");
							 *0x50c238 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"DrawThemeIcon");
							 *0x50c23c = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"IsThemePartDefined");
							 *0x50c240 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"IsThemeBackgroundPartiallyTransparent");
							 *0x50c244 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeColor");
							 *0x50c248 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeMetric");
							 *0x50c24c = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeString");
							 *0x50c250 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeBool");
							 *0x50c254 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeInt");
							 *0x50c258 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeEnumValue");
							 *0x50c25c = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemePosition");
							 *0x50c260 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeFont");
							 *0x50c264 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeRect");
							 *0x50c268 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeMargins");
							 *0x50c26c = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeIntList");
							 *0x50c270 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemePropertyOrigin");
							 *0x50c274 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"SetWindowTheme");
							 *0x50c278 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeFilename");
							 *0x50c27c = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeSysColor");
							 *0x50c280 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeSysColorBrush");
							 *0x50c284 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeSysBool");
							 *0x50c288 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeSysSize");
							 *0x50c28c = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeSysFont");
							 *0x50c290 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeSysString");
							 *0x50c294 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeSysInt");
							 *0x50c298 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"IsThemeActive");
							 *0x50c29c = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"IsAppThemed");
							 *0x50c2a0 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetWindowTheme");
							 *0x50c2a4 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"EnableThemeDialogTexture");
							 *0x50c2a8 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"IsThemeDialogTextureEnabled");
							 *0x50c2ac = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeAppProperties");
							 *0x50c2b0 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"SetThemeAppProperties");
							 *0x50c2b4 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetCurrentThemeName");
							 *0x50c2b8 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"GetThemeDocumentationProperty");
							 *0x50c2bc = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"DrawThemeParentBackground");
							_t9 = E00409620(0x50c2c4, _t125,  *0x50c2c4, L"EnableTheming");
							 *0x50c2c0 = 0;
						}
					}
				}
				_pop(_t121);
				 *[fs:eax] = _t121;
				_push(0x4a5618);
				return L00406440( &_v12, 2);
			}

0x004a5230
0x004a5233
0x004a5235
0x004a5237
0x004a523f
0x004a5240
0x004a5245
0x004a5248
0x004a524b
0x004a5254
0x004a525a
0x004a5261
0x004a526a
0x004a5275
0x004a5282
0x004a5290
0x004a5295
0x004a529a
0x004a52ad
0x004a52bf
0x004a52d1
0x004a52e3
0x004a52f5
0x004a5307
0x004a5319
0x004a532b
0x004a533d
0x004a534f
0x004a5361
0x004a5373
0x004a5385
0x004a5397
0x004a53a9
0x004a53bb
0x004a53cd
0x004a53df
0x004a53f1
0x004a5403
0x004a5415
0x004a5427
0x004a5439
0x004a544b
0x004a545d
0x004a546f
0x004a5481
0x004a5493
0x004a54a5
0x004a54b7
0x004a54c9
0x004a54db
0x004a54ed
0x004a54ff
0x004a5511
0x004a5523
0x004a5535
0x004a5547
0x004a5559
0x004a556b
0x004a557d
0x004a558f
0x004a55a1
0x004a55b3
0x004a55c5
0x004a55d7
0x004a55e4
0x004a55e9
0x004a55e9
0x004a529a
0x004a5261
0x004a55f8
0x004a55fb
0x004a55fe
0x004a5610

APIs

Part of subcall function 004A51AC: GetVersionExW.KERNEL32(00000114), ref: 004A51C9

Part of subcall function 004A5200: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004A5218

LoadLibraryW.KERNEL32(00000000,00000000,004A5611,?,?,00000000,00000000), ref: 004A5290

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,00000000,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409666

Strings

GetThemeTextMetrics, xrefs: 004A5330
GetWindowTheme, xrefs: 004A554C
EnableTheming, xrefs: 004A55DC
uxtheme.dll, xrefs: 004A527D
GetThemeSysFont, xrefs: 004A54F2
GetThemeString, xrefs: 004A53D2
GetThemeBackgroundContentRect, xrefs: 004A52E8, 004A52FA
GetThemeIntList, xrefs: 004A5462
DrawThemeIcon, xrefs: 004A5378
GetThemeFont, xrefs: 004A542C
IsThemeActive, xrefs: 004A5528
GetThemeRect, xrefs: 004A543E
GetThemeDocumentationProperty, xrefs: 004A55B8
DrawThemeBackground, xrefs: 004A52C4
DrawThemeText, xrefs: 004A52D6
GetThemePartSize, xrefs: 004A530C
DrawThemeParentBackground, xrefs: 004A55CA
HitTestThemeBackground, xrefs: 004A5354
GetThemeBool, xrefs: 004A53E4
OpenThemeData, xrefs: 004A52A0
GetThemeColor, xrefs: 004A53AE
GetThemeEnumValue, xrefs: 004A5408
GetThemeBackgroundRegion, xrefs: 004A5342
IsThemeDialogTextureEnabled, xrefs: 004A5570
GetThemePropertyOrigin, xrefs: 004A5474
GetThemeSysColorBrush, xrefs: 004A54BC
SetThemeAppProperties, xrefs: 004A5594
GetThemeMetric, xrefs: 004A53C0
DrawThemeEdge, xrefs: 004A5366
IsThemePartDefined, xrefs: 004A538A
GetThemeInt, xrefs: 004A53F6
EnableThemeDialogTexture, xrefs: 004A555E
GetThemeSysString, xrefs: 004A5504
GetThemeSysColor, xrefs: 004A54AA
GetThemePosition, xrefs: 004A541A
GetThemeSysInt, xrefs: 004A5516
GetThemeTextExtent, xrefs: 004A531E
CloseThemeData, xrefs: 004A52B2
GetThemeSysBool, xrefs: 004A54CE
GetCurrentThemeName, xrefs: 004A55A6
GetThemeSysSize, xrefs: 004A54E0
IsThemeBackgroundPartiallyTransparent, xrefs: 004A539C
GetThemeFilename, xrefs: 004A5498
GetThemeAppProperties, xrefs: 004A5582
SetWindowTheme, xrefs: 004A5486
GetThemeMargins, xrefs: 004A5450
IsAppThemed, xrefs: 004A553A

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystemVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 2754715182-2910565190
Opcode ID: 95dff210ff72ad3fb9201bfe5739763bc32c8fb569563e5331caa00da026512d
Instruction ID: 9ceafd9049bc226b6458fa1dab59227c54020ac294e2cd3feae2af878c3cae0f
Opcode Fuzzy Hash: 95dff210ff72ad3fb9201bfe5739763bc32c8fb569563e5331caa00da026512d
Instruction Fuzzy Hash: DCA124B4E40B11AFDB00EFB5DD82A2A37A8EB277047500A7BB440DF696D67C9C04DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00415670, Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00415670() {
				struct HINSTANCE__* _v8;
				intOrPtr _t46;
				void* _t91;

				_v8 = GetModuleHandleW(L"oleaut32.dll");
				 *0x50bdc0 = E00415644("VariantChangeTypeEx", E004151CC, _t91);
				 *0x50bdc4 = E00415644("VarNeg", E004151FC, _t91);
				 *0x50bdc8 = E00415644("VarNot", E004151FC, _t91);
				 *0x50bdcc = E00415644("VarAdd", E00415208, _t91);
				 *0x50bdd0 = E00415644("VarSub", E00415208, _t91);
				 *0x50bdd4 = E00415644("VarMul", E00415208, _t91);
				 *0x50bdd8 = E00415644("VarDiv", E00415208, _t91);
				 *0x50bddc = E00415644("VarIdiv", E00415208, _t91);
				 *0x50bde0 = E00415644("VarMod", E00415208, _t91);
				 *0x50bde4 = E00415644("VarAnd", E00415208, _t91);
				 *0x50bde8 = E00415644("VarOr", E00415208, _t91);
				 *0x50bdec = E00415644("VarXor", E00415208, _t91);
				 *0x50bdf0 = E00415644("VarCmp", E00415214, _t91);
				 *0x50bdf4 = E00415644("VarI4FromStr", E00415220, _t91);
				 *0x50bdf8 = E00415644("VarR4FromStr", E0041528C, _t91);
				 *0x50bdfc = E00415644("VarR8FromStr", E004152F8, _t91);
				 *0x50be00 = E00415644("VarDateFromStr", E00415364, _t91);
				 *0x50be04 = E00415644("VarCyFromStr", E004153D0, _t91);
				 *0x50be08 = E00415644("VarBoolFromStr", E0041543C, _t91);
				 *0x50be0c = E00415644("VarBstrFromCy", E004154BC, _t91);
				 *0x50be10 = E00415644("VarBstrFromDate", E0041552C, _t91);
				_t46 = E00415644("VarBstrFromBool", E004155A0, _t91);
				 *0x50be14 = _t46;
				return _t46;
			}

0x0041567e
0x00415692
0x004156a8
0x004156be
0x004156d4
0x004156ea
0x00415700
0x00415716
0x0041572c
0x00415742
0x00415758
0x0041576e
0x00415784
0x0041579a
0x004157b0
0x004157c6
0x004157dc
0x004157f2
0x00415808
0x0041581e
0x00415834
0x0041584a
0x0041585a
0x00415860
0x00415867

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 00415679

Part of subcall function 00415644: GetProcAddress.KERNEL32(00000000), ref: 0041565D

Strings

VarBstrFromCy, xrefs: 00415829
VarIdiv, xrefs: 00415721
VarOr, xrefs: 00415763
VarSub, xrefs: 004156DF
VarCmp, xrefs: 0041578F
VarBoolFromStr, xrefs: 00415813
VarCyFromStr, xrefs: 004157FD
VarBstrFromDate, xrefs: 0041583F
VarAdd, xrefs: 004156C9
oleaut32.dll, xrefs: 00415674
VarR8FromStr, xrefs: 004157D1
VarNot, xrefs: 004156B3
VarBstrFromBool, xrefs: 00415855
VarNeg, xrefs: 0041569D
VarXor, xrefs: 00415779
VarI4FromStr, xrefs: 004157A5
VarMul, xrefs: 004156F5
VarDiv, xrefs: 0041570B
VarMod, xrefs: 00415737
VarDateFromStr, xrefs: 004157E7
VarAnd, xrefs: 0041574D
VariantChangeTypeEx, xrefs: 00415687
VarR4FromStr, xrefs: 004157BB

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 65c8ed7f17fc0e6b4d50f36525ebb22d56803ade45326be85ceaa56cf1b6c19e
Instruction ID: ca13620692df8371206141a036cf567af81d1df921fb2cda0a9241cfdd2f26b5
Opcode Fuzzy Hash: 65c8ed7f17fc0e6b4d50f36525ebb22d56803ade45326be85ceaa56cf1b6c19e
Instruction Fuzzy Hash: 3C413B72614E08DBA3046BAEB8425EA77D9D6E17143A4C02FF0088F351DB3CACC59A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00432B94, Relevance: 37.7, APIs: 25, Instructions: 245
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00432B94(struct HDC__* __eax, void* __ebx, int __ecx, int __edx, void* __edi, void* __esi, int _a4, int _a8, struct HDC__* _a12, int _a16, int _a20, int _a24, int _a28, struct HDC__* _a32, int _a36, int _a40) {
				int _v8;
				int _v12;
				char _v13;
				struct HDC__* _v20;
				void* _v24;
				void* _v28;
				long _v32;
				long _v36;
				struct HPALETTE__* _v40;
				intOrPtr* _t78;
				struct HPALETTE__* _t89;
				struct HPALETTE__* _t95;
				int _t169;
				intOrPtr _t176;
				intOrPtr _t177;
				struct HDC__* _t179;
				int _t181;
				void* _t183;
				void* _t184;
				intOrPtr _t185;

				_t183 = _t184;
				_t185 = _t184 + 0xffffffdc;
				_v12 = __ecx;
				_v8 = __edx;
				_t179 = __eax;
				_t181 = _a16;
				_t169 = _a20;
				_v13 = 1;
				_t78 =  *0x50605c; // 0x503914
				if( *_t78 != 2 || _t169 != _a40 || _t181 != _a36) {
					_v40 = 0;
					_v20 = E004329E4(CreateCompatibleDC(0));
					_push(_t183);
					_push(0x432e09);
					_push( *[fs:eax]);
					 *[fs:eax] = _t185;
					_v24 = E004329E4(CreateCompatibleBitmap(_a32, _t169, _t181));
					_v28 = SelectObject(_v20, _v24);
					_t89 =  *0x50beec; // 0x3b0806eb
					_v40 = SelectPalette(_a32, _t89, 0);
					SelectPalette(_a32, _v40, 0);
					if(_v40 == 0) {
						_t95 =  *0x50beec; // 0x3b0806eb
						_v40 = SelectPalette(_v20, _t95, 0xffffffff);
					} else {
						_v40 = SelectPalette(_v20, _v40, 0xffffffff);
					}
					RealizePalette(_v20);
					StretchBlt(_v20, 0, 0, _t169, _t181, _a12, _a8, _a4, _t169, _t181, 0xcc0020);
					StretchBlt(_v20, 0, 0, _t169, _t181, _a32, _a28, _a24, _t169, _t181, 0x440328);
					_v32 = SetTextColor(_t179, 0);
					_v36 = SetBkColor(_t179, 0xffffff);
					StretchBlt(_t179, _v8, _v12, _a40, _a36, _a12, _a8, _a4, _t169, _t181, 0x8800c6);
					StretchBlt(_t179, _v8, _v12, _a40, _a36, _v20, 0, 0, _t169, _t181, 0x660046);
					SetTextColor(_t179, _v32);
					SetBkColor(_t179, _v36);
					if(_v28 != 0) {
						SelectObject(_v20, _v28);
					}
					DeleteObject(_v24);
					_pop(_t176);
					 *[fs:eax] = _t176;
					_push(0x432e10);
					if(_v40 != 0) {
						SelectPalette(_v20, _v40, 0);
					}
					return DeleteDC(_v20);
				} else {
					_v24 = E004329E4(CreateCompatibleBitmap(_a32, 1, 1));
					_v24 = SelectObject(_a12, _v24);
					_push(_t183);
					_push(0x432c5c);
					_push( *[fs:eax]);
					 *[fs:eax] = _t185;
					MaskBlt(_t179, _v8, _v12, _a40, _a36, _a32, _a28, _a24, _v24, _a8, _a4, 0xccaa0029);
					_pop(_t177);
					 *[fs:eax] = _t177;
					_push(0x432e10);
					_v24 = SelectObject(_a12, _v24);
					return DeleteObject(_v24);
				}
			}

0x00432b95
0x00432b97
0x00432b9d
0x00432ba0
0x00432ba3
0x00432ba5
0x00432ba8
0x00432bab
0x00432baf
0x00432bb7
0x00432c65
0x00432c74
0x00432c79
0x00432c7a
0x00432c7f
0x00432c82
0x00432c95
0x00432ca5
0x00432caa
0x00432cb9
0x00432cc6
0x00432ccf
0x00432ce7
0x00432cf6
0x00432cd1
0x00432ce0
0x00432ce0
0x00432cfd
0x00432d1f
0x00432d41
0x00432d4e
0x00432d5c
0x00432d83
0x00432da8
0x00432db2
0x00432dbc
0x00432dc5
0x00432dcf
0x00432dcf
0x00432dd8
0x00432ddf
0x00432de2
0x00432de5
0x00432dee
0x00432dfa
0x00432dfa
0x00432e08
0x00432bcf
0x00432be1
0x00432bf1
0x00432bf6
0x00432bf7
0x00432bfc
0x00432bff
0x00432c30
0x00432c37
0x00432c3a
0x00432c3d
0x00432c4f
0x00432c5b
0x00432c5b

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001,00000000,?,?), ref: 00432BD7
SelectObject.GDI32(?,?,?,00000001,00000001,00000000,?,?), ref: 00432BEC
MaskBlt.GDI32(?,?,?,?,?,?,00000000,00431CBA,?,?,?,CCAA0029,00000000,00432C5C,?,?), ref: 00432C30
SelectObject.GDI32(?,?,00432E10,?,?,?,00000000,00431CBA,?,?,?,CCAA0029,00000000,00432C5C,?,?), ref: 00432C4A
DeleteObject.GDI32(?,?,?,00432E10,?,?,?,00000000,00431CBA,?,?,?,CCAA0029,00000000,00432C5C), ref: 00432C56
CreateCompatibleDC.GDI32(00000000,00000000,?,?), ref: 00432C6A
CreateCompatibleBitmap.GDI32(?,?,?,00000000,00432E09,?,00000000,00000000,?,?), ref: 00432C8B
SelectObject.GDI32(?,?,?,?,?,00000000,00432E09,?,00000000,00000000,?,?), ref: 00432CA0
SelectPalette.GDI32(?,3B0806EB,00000000,?,?,?,?,?,00000000,00432E09,?,00000000,00000000,?,?), ref: 00432CB4
SelectPalette.GDI32(?,?,00000000,?,3B0806EB,00000000,?,?,?,?,?,00000000,00432E09,?,00000000,00000000), ref: 00432CC6
SelectPalette.GDI32(?,00000000,000000FF,?,?,00000000,?,3B0806EB,00000000,?,?,?,?,?,00000000,00432E09), ref: 00432CDB
SelectPalette.GDI32(?,3B0806EB,000000FF,?,?,00000000,?,3B0806EB,00000000,?,?,?,?,?,00000000,00432E09), ref: 00432CF1
RealizePalette.GDI32(?,?,3B0806EB,000000FF,?,?,00000000,?,3B0806EB,00000000,?,?,?,?,?,00000000), ref: 00432CFD
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020,?,?,3B0806EB,000000FF,?), ref: 00432D1F
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00431CBA,?,?,00440328,?,00000000,00000000,?,?), ref: 00432D41
SetTextColor.GDI32(?,00000000,?,00000000,00000000,?,?,00000000,00000000,00431CBA,?,?,00440328,?,00000000,00000000), ref: 00432D49
SetBkColor.GDI32(?,00FFFFFF,?,00000000,?,00000000,00000000,?,?,00000000,00000000,00431CBA,?,?,00440328,?), ref: 00432D57
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6,?,00FFFFFF,?,00000000,?), ref: 00432D83
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046,?,?,?,?,?), ref: 00432DA8
SetTextColor.GDI32(?,00431CBA,?,?,?,?,?,?,00000000,00000000,?,?,00660046,?,?,?), ref: 00432DB2
SetBkColor.GDI32(?,00000000,?,00431CBA,?,?,?,?,?,?,00000000,00000000,?,?,00660046,?), ref: 00432DBC
SelectObject.GDI32(?,00000000,?,00000000,?,00431CBA,?,?,?,?,?,?,00000000,00000000,?,?), ref: 00432DCF
DeleteObject.GDI32(?,?,00000000,?,00431CBA,?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 00432DD8
SelectPalette.GDI32(?,00000000,00000000,00432E10,?,00431CBA,?,?,?,?,?,?,00000000,00000000,?,?), ref: 00432DFA
DeleteDC.GDI32(?,00432E10,?,00431CBA,?,?,?,?,?,?,00000000,00000000,?,?,00660046,?), ref: 00432E03

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: 4f1bb31e84712ae28fb6d74709daf895300ec74ffcac12270527baf4beca5d9c
Instruction ID: 67e10517248b25ec2aa53caf54e6b11572694d7c8ea5e85ae547dae41efce017
Opcode Fuzzy Hash: 4f1bb31e84712ae28fb6d74709daf895300ec74ffcac12270527baf4beca5d9c
Instruction Fuzzy Hash: D48183B1A00249AFDB50DEA9CD85FAF77FCAB0C714F150459F618F7282C679AD008B65

Uniqueness

Uniqueness Score: -1.00%

Function 00434BA8, Relevance: 31.7, APIs: 21, Instructions: 194
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00434BA8(void* __eax, long __ecx, struct HPALETTE__* __edx) {
				struct HBITMAP__* _v8;
				struct HDC__* _v12;
				struct HDC__* _v16;
				struct HDC__* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				intOrPtr _v92;
				intOrPtr _v96;
				int _v108;
				int _v112;
				void _v116;
				int _t68;
				long _t82;
				void* _t117;
				intOrPtr _t126;
				intOrPtr _t127;
				long _t130;
				struct HPALETTE__* _t133;
				void* _t137;
				void* _t139;
				intOrPtr _t140;

				_t137 = _t139;
				_t140 = _t139 + 0xffffff90;
				_t130 = __ecx;
				_t133 = __edx;
				_t117 = __eax;
				_v8 = 0;
				if(__eax == 0 || GetObjectW(__eax, 0x54,  &_v116) == 0) {
					return _v8;
				} else {
					E0043406C(_t117);
					_v12 = 0;
					_v20 = 0;
					_push(_t137);
					_push(0x434da3);
					_push( *[fs:eax]);
					 *[fs:eax] = _t140;
					_v12 = E004329E4(GetDC(0));
					_v20 = E004329E4(CreateCompatibleDC(_v12));
					_v8 = CreateBitmap(_v112, _v108, 1, 1, 0);
					if(_v8 == 0) {
						L17:
						_t68 = 0;
						_pop(_t126);
						 *[fs:eax] = _t126;
						_push(0x434daa);
						if(_v20 != 0) {
							_t68 = DeleteDC(_v20);
						}
						if(_v12 != 0) {
							return ReleaseDC(0, _v12);
						}
						return _t68;
					} else {
						_v32 = SelectObject(_v20, _v8);
						if(_t130 != 0x1fffffff) {
							_v16 = E004329E4(CreateCompatibleDC(_v12));
							_push(_t137);
							_push(0x434d5b);
							_push( *[fs:eax]);
							 *[fs:eax] = _t140;
							if(_v96 == 0) {
								_v21 = 0;
							} else {
								_v21 = 1;
								_v92 = 0;
								_t117 = E004344E0(_t117, _t133, _t133, 0,  &_v116);
							}
							_v28 = SelectObject(_v16, _t117);
							if(_t133 != 0) {
								SelectPalette(_v16, _t133, 0);
								RealizePalette(_v16);
								SelectPalette(_v20, _t133, 0);
								RealizePalette(_v20);
							}
							_t82 = SetBkColor(_v16, _t130);
							BitBlt(_v20, 0, 0, _v112, _v108, _v16, 0, 0, 0xcc0020);
							SetBkColor(_v16, _t82);
							if(_v28 != 0) {
								SelectObject(_v16, _v28);
							}
							if(_v21 != 0) {
								DeleteObject(_t117);
							}
							_pop(_t127);
							 *[fs:eax] = _t127;
							_push(0x434d62);
							return DeleteDC(_v16);
						} else {
							PatBlt(_v20, 0, 0, _v112, _v108, 0x42);
							if(_v32 != 0) {
								SelectObject(_v20, _v32);
							}
							goto L17;
						}
					}
				}
			}

0x00434ba9
0x00434bab
0x00434bb1
0x00434bb3
0x00434bb5
0x00434bb9
0x00434bbe
0x00434db3
0x00434bd8
0x00434bda
0x00434be1
0x00434be6
0x00434beb
0x00434bec
0x00434bf1
0x00434bf4
0x00434c03
0x00434c14
0x00434c2a
0x00434c31
0x00434d75
0x00434d75
0x00434d77
0x00434d7a
0x00434d7d
0x00434d86
0x00434d8c
0x00434d8c
0x00434d95
0x00000000
0x00434d9d
0x00434da2
0x00434c37
0x00434c44
0x00434c4d
0x00434c79
0x00434c7e
0x00434c7f
0x00434c84
0x00434c87
0x00434c8e
0x00434cae
0x00434c90
0x00434c90
0x00434c96
0x00434caa
0x00434caa
0x00434cbc
0x00434cc1
0x00434cca
0x00434cd3
0x00434cdf
0x00434ce8
0x00434ce8
0x00434cf2
0x00434d16
0x00434d20
0x00434d29
0x00434d33
0x00434d33
0x00434d3c
0x00434d3f
0x00434d3f
0x00434d46
0x00434d49
0x00434d4c
0x00434d5a
0x00434c4f
0x00434c61
0x00434d66
0x00434d70
0x00434d70
0x00000000
0x00434d66
0x00434c4d
0x00434c31

APIs

GetObjectW.GDI32(00000000,00000054,?,00000000,?,?), ref: 00434BCB
GetDC.USER32(00000000,00000000,00434DA3,?,00000000,00000054,?,00000000,?,?), ref: 00434BF9
CreateCompatibleDC.GDI32(?,00000000,00000000,00434DA3,?,00000000,00000054,?,00000000,?,?), ref: 00434C0A
CreateBitmap.GDI32(?,?,00000001,00000001,00000000,?,00000000,00000000,00434DA3,?,00000000,00000054,?,00000000,?,?), ref: 00434C25
SelectObject.GDI32(?,00000000,?,?,00000001,00000001,00000000,?,00000000,00000000,00434DA3,?,00000000,00000054,?,00000000), ref: 00434C3F
PatBlt.GDI32(?,00000000,00000000,?,?,00000042,?,00000000,?,?,00000001,00000001,00000000,?,00000000,00000000), ref: 00434C61
CreateCompatibleDC.GDI32(?,?,00000000,?,?,00000001,00000001,00000000,?,00000000,00000000,00434DA3,?,00000000,00000054,?), ref: 00434C6F
SelectObject.GDI32(00000000,00000000,00000000,00434D5B,?,?,?,00000000,?,?,00000001,00000001,00000000,?,00000000,00000000), ref: 00434CB7
SelectPalette.GDI32(00000000,?,00000000,00000000,00000000,00000000,00434D5B,?,?,?,00000000,?,?,00000001,00000001,00000000), ref: 00434CCA
RealizePalette.GDI32(00000000,00000000,?,00000000,00000000,00000000,00000000,00434D5B,?,?,?,00000000,?,?,00000001,00000001), ref: 00434CD3
SelectPalette.GDI32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00434D5B,?,?,?,00000000,?), ref: 00434CDF
RealizePalette.GDI32(?,?,?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00434D5B,?,?,?,00000000), ref: 00434CE8
SetBkColor.GDI32(00000000,00000000,00000000,00000000,00000000,00434D5B,?,?,?,00000000,?,?,00000001,00000001,00000000,?), ref: 00434CF2
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,00000000,00000000,00434D5B), ref: 00434D16
SetBkColor.GDI32(00000000,00000000,?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,00000000,00000000), ref: 00434D20
SelectObject.GDI32(00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000), ref: 00434D33
DeleteObject.GDI32(00000000,00000000,00000000,?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,00000000), ref: 00434D3F
DeleteDC.GDI32(00000000,00434D62,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,00000000,00000000,00434D5B), ref: 00434D55
SelectObject.GDI32(?,00000000,?,00000000,00000000,?,?,00000042,?,00000000,?,?,00000001,00000001,00000000,?), ref: 00434D70
DeleteDC.GDI32(00000000,00434DAA,00000001,00000000,?,00000000,00000000,00434DA3,?,00000000,00000054,?,00000000,?,?), ref: 00434D8C
ReleaseDC.USER32(00000000,00000000,00434DAA,00000001,00000000,?,00000000,00000000,00434DA3,?,00000000,00000054,?,00000000,?,?), ref: 00434D9D

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 97a44a0d2783b55284ae56d947e50b37649302cc1c5b68960b467da2b78d8b00
Instruction ID: 75f54a123c315d5356c4c810129b0b99f0edf44bd2f5934a7199879f8a94d3de
Opcode Fuzzy Hash: 97a44a0d2783b55284ae56d947e50b37649302cc1c5b68960b467da2b78d8b00
Instruction Fuzzy Hash: 6D510F71E00244ABDB50DAE9CC56FEFB7FCAB4C704F10546AB214E72D2D678A9408B58

Uniqueness

Uniqueness Score: -1.00%

Function 00435F64, Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 352
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00435F64(intOrPtr __eax, void* __ebx, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi, void* __fp0, char* _a4) {
				intOrPtr _v8;
				intOrPtr* _v12;
				struct HDC__* _v16;
				struct HDC__* _v20;
				void* _v24;
				BITMAPINFOHEADER* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v37;
				struct HBITMAP__* _v44;
				void* _v48;
				struct HPALETTE__* _v52;
				struct HPALETTE__* _v56;
				intOrPtr* _v60;
				intOrPtr* _v64;
				signed short _v66;
				signed short _v68;
				signed short _v70;
				signed short _v72;
				void* _v76;
				intOrPtr _v172;
				char _v174;
				intOrPtr _t152;
				signed int _t162;
				signed int _t166;
				intOrPtr _t170;
				signed int _t225;
				intOrPtr _t252;
				intOrPtr* _t256;
				intOrPtr _t262;
				signed int _t299;
				intOrPtr _t302;
				intOrPtr _t303;
				intOrPtr _t308;
				signed int _t329;
				void* _t331;
				void* _t332;
				signed int _t333;
				void* _t334;
				void* _t335;
				void* _t336;
				intOrPtr _t337;

				_t328 = __edi;
				_t335 = _t336;
				_t337 = _t336 + 0xffffff54;
				_t331 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v52 = 0;
				_v44 = 0;
				_v60 = 0;
				 *((intOrPtr*)( *_v12 + 0xc))(__edi, __esi, __ebx, _t334);
				_v37 = _v36 == 0xc;
				if(_v37 != 0) {
					_v36 = 0x28;
				}
				_v28 = E00403018(_v36 + 0x40c);
				_v64 = _v28;
				_push(_t335);
				_push(0x436487);
				_push( *[fs:edx]);
				 *[fs:edx] = _t337;
				_push(_t335);
				_push(0x43645a);
				_push( *[fs:edx]);
				 *[fs:edx] = _t337;
				if(_v37 == 0) {
					 *((intOrPtr*)( *_v12 + 0xc))();
					_t332 = _t331 - _v36;
					_t152 =  *((intOrPtr*)(_v64 + 0x10));
					if(_t152 != 3 && _t152 != 0) {
						_v60 = E00404068(1);
						if(_a4 == 0) {
							E00403540( &_v174, 0xe);
							_v174 = 0x4d42;
							_v172 = _v36 + _t332;
							_a4 =  &_v174;
						}
						 *((intOrPtr*)( *_v60 + 0x10))();
						 *((intOrPtr*)( *_v60 + 0x10))();
						 *((intOrPtr*)( *_v60 + 0x10))();
						E00426180(_v60,  *_v60, _v12, _t328, _t332, _t332, 0);
						 *((intOrPtr*)( *_v60 + 0x14))();
						_v12 = _v60;
					}
				} else {
					 *((intOrPtr*)( *_v12 + 0xc))();
					_t262 = _v64;
					E00403540(_t262, 0x28);
					_t252 = _t262;
					 *(_t252 + 4) = _v72 & 0x0000ffff;
					 *(_t252 + 8) = _v70 & 0x0000ffff;
					 *((short*)(_t252 + 0xc)) = _v68 & 0x0000ffff;
					 *((short*)(_t252 + 0xe)) = _v66 & 0x0000ffff;
					_t332 = _t331 - 0xc;
				}
				_t256 = _v64;
				 *_t256 = _v36;
				_v32 = _v28 + _v36;
				if( *((short*)(_t256 + 0xc)) != 1) {
					E004328D0();
				}
				if(_v36 == 0x28) {
					_t225 =  *(_t256 + 0xe) & 0x0000ffff;
					if(_t225 == 0x10 || _t225 == 0x20) {
						if( *((intOrPtr*)(_t256 + 0x10)) == 3) {
							E00426110(_v12, 0xc, _v32);
							_v32 = _v32 + 0xc;
							_t332 = _t332 - 0xc;
						}
					}
				}
				if( *(_t256 + 0x20) == 0) {
					 *(_t256 + 0x20) = E00432B54( *(_t256 + 0xe) & 0x0000ffff);
				}
				_t329 = _v37 & 0x000000ff;
				_t79 = _t329 + 0x504274; // 0xc08b0304
				E00426110(_v12,  *(_t256 + 0x20) * ( *_t79 & 0x000000ff), _v32);
				_t83 = _t329 + 0x504274; // 0xc08b0304
				_t333 = _t332 -  *(_t256 + 0x20) * ( *_t83 & 0x000000ff);
				if( *(_t256 + 0x14) == 0 ||  *((intOrPtr*)(_t256 + 0x10)) == 0) {
					_t299 =  *(_t256 + 0xe) & 0x0000ffff;
					_t162 = E00432B74( *((intOrPtr*)(_t256 + 4)), 0x20, _t299);
					asm("cdq");
					 *(_t256 + 0x14) = _t162 * (( *(_t256 + 8) ^ _t299) - _t299);
				}
				_t166 =  *(_t256 + 0x14);
				if(_t333 > _t166) {
					_t333 = _t166;
				}
				if(_v37 != 0) {
					E00432E20(_v32);
				}
				_v16 = E004329E4(GetDC(0));
				_push(_t335);
				_push(0x4363d5);
				_push( *[fs:edx]);
				 *[fs:edx] = _t337;
				_t170 =  *((intOrPtr*)(_v64 + 0x10));
				if(_t170 == 0 || _t170 == 3) {
					if( *0x503f94 == 0) {
						_v44 = CreateDIBSection(_v16, _v28, 0,  &_v24, 0, 0);
						if(_v44 == 0 || _v24 == 0) {
							if(GetLastError() != 0) {
								E0041362C();
							} else {
								E004328D0();
							}
						}
						_push(_t335);
						_push( *[fs:eax]);
						 *[fs:eax] = _t337;
						E00426110(_v12, _t333, _v24);
						_pop(_t302);
						 *[fs:eax] = _t302;
						_t303 = 0x4363a4;
						 *[fs:eax] = _t303;
						_push(0x4363dc);
						return ReleaseDC(0, _v16);
					} else {
						goto L28;
					}
				} else {
					L28:
					_v20 = 0;
					_v24 = E00403018(_t333);
					_push(_t335);
					_push(0x43633d);
					_push( *[fs:edx]);
					 *[fs:edx] = _t337;
					E00426110(_v12, _t333, _v24);
					_v20 = E004329E4(CreateCompatibleDC(_v16));
					_v48 = SelectObject(_v20, CreateCompatibleBitmap(_v16, 1, 1));
					_v56 = 0;
					_t199 =  *((intOrPtr*)(_v64 + 0x20));
					if( *((intOrPtr*)(_v64 + 0x20)) > 0) {
						_v52 = E004330DC(0, _t199);
						_v56 = SelectPalette(_v20, _v52, 0);
						RealizePalette(_v20);
					}
					_push(_t335);
					_push(0x436311);
					_push( *[fs:edx]);
					 *[fs:edx] = _t337;
					_v44 = CreateDIBitmap(_v20, _v28, 4, _v24, _v28, 0);
					if(_v44 == 0) {
						if(GetLastError() != 0) {
							E0041362C();
						} else {
							E004328D0();
						}
					}
					_pop(_t308);
					 *[fs:eax] = _t308;
					_push(0x436318);
					if(_v56 != 0) {
						SelectPalette(_v20, _v56, 0xffffffff);
					}
					return DeleteObject(SelectObject(_v20, _v48));
				}
			}

0x00435f64
0x00435f65
0x00435f67
0x00435f70
0x00435f72
0x00435f75
0x00435f7a
0x00435f7f
0x00435f84
0x00435f94
0x00435f9b
0x00435fa3
0x00435fa5
0x00435fa5
0x00435fbc
0x00435fc2
0x00435fc7
0x00435fc8
0x00435fcd
0x00435fd0
0x00435fd5
0x00435fd6
0x00435fdb
0x00435fde
0x00435fe5
0x00436044
0x0043604a
0x0043604f
0x00436055
0x0043606f
0x00436076
0x00436085
0x0043608a
0x00436098
0x004360a4
0x004360a4
0x004360b4
0x004360c4
0x004360d8
0x004360e7
0x004360f9
0x004360ff
0x004360ff
0x00435fe7
0x00435ff7
0x00435ffa
0x00436006
0x0043600b
0x00436011
0x00436018
0x0043601f
0x00436027
0x0043602b
0x0043602b
0x00436102
0x00436108
0x00436110
0x00436118
0x0043611a
0x0043611a
0x00436123
0x00436125
0x0043612d
0x00436139
0x00436146
0x0043614b
0x0043614f
0x0043614f
0x00436139
0x0043612d
0x00436156
0x00436161
0x00436161
0x00436167
0x0043616b
0x0043617b
0x00436183
0x0043618c
0x00436192
0x0043619a
0x004361a6
0x004361b0
0x004361b8
0x004361b8
0x004361bb
0x004361c0
0x004361c2
0x004361c2
0x004361c8
0x004361cd
0x004361cd
0x004361de
0x004361e3
0x004361e4
0x004361e9
0x004361ec
0x004361f2
0x004361f7
0x00436205
0x0043635b
0x00436362
0x00436371
0x0043637a
0x00436373
0x00436373
0x00436373
0x00436371
0x00436381
0x00436387
0x0043638a
0x00436395
0x0043639c
0x0043639f
0x004363be
0x004363c1
0x004363c4
0x004363d4
0x00000000
0x00000000
0x00000000
0x0043620b
0x0043620b
0x0043620d
0x00436217
0x0043621c
0x0043621d
0x00436222
0x00436225
0x00436230
0x00436243
0x0043625d
0x00436262
0x00436268
0x0043626d
0x0043627b
0x0043628d
0x00436294
0x00436294
0x0043629b
0x0043629c
0x004362a1
0x004362a4
0x004362bd
0x004362c4
0x004362cd
0x004362d6
0x004362cf
0x004362cf
0x004362cf
0x004362cd
0x004362dd
0x004362e0
0x004362e3
0x004362ec
0x004362f8
0x004362f8
0x00436310
0x00436310

APIs

GetDC.USER32(00000000,?,00000000,00436487,?,?), ref: 004361D4
CreateCompatibleDC.GDI32(00000001,00000000,0043633D,?,00000000,004363D5,?,00000000,?,00000000,00436487,?,?), ref: 00436239
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001,00000001,00000000,0043633D,?,00000000,004363D5,?,00000000,?,00000000,00436487,?,?), ref: 0043624E
SelectObject.GDI32(?,00000000,00000001,00000001,00000001,00000001,00000000,0043633D,?,00000000,004363D5,?,00000000,?,00000000,00436487), ref: 00436258
SelectPalette.GDI32(?,?,00000000,?,00000000,00000001,00000001,00000001,00000001,00000000,0043633D,?,00000000,004363D5,?,00000000), ref: 00436288
RealizePalette.GDI32(?,?,?,00000000,?,00000000,00000001,00000001,00000001,00000001,00000000,0043633D,?,00000000,004363D5), ref: 00436294
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000,00000000,00436311,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 004362B8
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,00436311,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 004362C6
SelectPalette.GDI32(?,00000000,000000FF,00436318,00000000,?,00000000,00000000,00436311,?,?,00000000,00000001,00000001,00000001,00000001), ref: 004362F8
SelectObject.GDI32(?,?,00436318,00000000,?,00000000,00000000,00436311,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 00436305
DeleteObject.GDI32(00000000,?,?,00436318,00000000,?,00000000,00000000,00436311,?,?,00000000,00000001,00000001,00000001,00000001), ref: 0043630B

Strings

BM, xrefs: 0043608A
(, xrefs: 0043611F

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: ea6d87c1c1e2edd08518568667ea22e4f2d70034a3e9b8bb95afa162c655ee08
Instruction ID: a644d7cc580bf323b5ecba6370fd7954a9f70e44c67f5750896d2db6aa28b8a9
Opcode Fuzzy Hash: ea6d87c1c1e2edd08518568667ea22e4f2d70034a3e9b8bb95afa162c655ee08
Instruction Fuzzy Hash: 38D12F70A00219AFDF14DFA9C885AAEBBF5FF4C304F11846AE914A7396D7789C40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004FFFD0, Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 268
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E004FFFD0(void* __ebx, void* __edi, char __esi, void* __fp0) {
				char _v8;
				char _v12;
				void* _v16;
				char _v20;
				char _v21;
				signed int _v22;
				void* _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v60;
				void* _t64;
				signed int _t114;
				intOrPtr _t132;
				signed int _t133;
				char _t137;
				char _t142;
				char _t145;
				char* _t152;
				signed int _t162;
				void* _t163;
				intOrPtr _t185;
				intOrPtr _t193;
				intOrPtr _t194;
				intOrPtr _t196;
				intOrPtr _t200;
				intOrPtr _t203;
				intOrPtr* _t208;
				intOrPtr _t210;
				intOrPtr _t211;
				void* _t220;

				_t220 = __fp0;
				_t207 = __esi;
				_t206 = __edi;
				_t210 = _t211;
				_t163 = 7;
				do {
					_push(0);
					_push(0);
					_t163 = _t163 - 1;
				} while (_t163 != 0);
				_push(__esi);
				_push(__edi);
				_t162 =  *0x505e5c; // 0x50c17c
				_push(_t210);
				_push(0x5003a4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t211;
				E0047F334(1, _t162,  &_v36, __edi, __esi);
				_t64 = E0040C2BC(_v36, _t163, L"/REG");
				_t213 = _t64;
				if(_t64 != 0) {
					E0047F334(1, _t162,  &_v40, __edi, __esi);
					__eflags = E0040C2BC(_v40, _t163, L"/REGU");
					if(__eflags != 0) {
						__eflags = 0;
						_pop(_t185);
						 *[fs:eax] = _t185;
						_push(E005003AB);
						L00406440( &_v60, 7);
						return L00406440( &_v20, 4);
					} else {
						_v21 = 0;
						goto L6;
					}
				} else {
					_v21 = 1;
					L6:
					E0047BFC0( *_t162, _t163, L"Setup", _t213);
					ShowWindow( *( *_t162 + 0x170), 5);
					E004E2ADC();
					_v28 = E00409458(0, 0, L"Inno-Setup-RegSvr-Mutex");
					ShowWindow( *( *_t162 + 0x170), 0);
					if(_v28 != 0) {
						do {
							E0047C440( *_t162);
						} while (MsgWaitForMultipleObjects(1,  &_v28, 0, 0xffffffff, 0xff) == 1);
					}
					ShowWindow( *( *_t162 + 0x170), 5);
					_push(_t210);
					_push(0x500375);
					_push( *[fs:eax]);
					 *[fs:eax] = _t211;
					_t13 =  &_v44; // 0x502653
					E0047F334(0, _t162, _t13, _t206, _t207);
					_t14 =  &_v44; // 0x502653
					E0047E418( *_t14, _t162,  &_v8, L".msg", _t206, _t207);
					E0047F334(0, _t162,  &_v48, _t206, _t207);
					E0047E418(_v48, _t162,  &_v12, L".lst", _t206, _t207);
					if(E0047EBDC(_v12) == 0) {
						DeleteFileW(E004064D4(_v12));
						DeleteFileW(E004064D4(_v8));
						_push(_t210);
						_push( *[fs:eax]);
						 *[fs:eax] = _t211;
						E004FFF30(_t162,  &_v12, _t206, _t207, __eflags);
						_pop(_t193);
						 *[fs:eax] = _t193;
						_t194 = 0x500345;
						 *[fs:eax] = _t194;
						_push(E0050037C);
						__eflags = _v28;
						if(_v28 != 0) {
							ReleaseMutex(_v28);
							return CloseHandle(_v28);
						}
						return 0;
					} else {
						E004AC058(_v8, _t162, 1, 0, _t206, _t207);
						_t114 =  *0x505db0; // 0x50cbb0
						E00481268(_t114 & 0xffffff00 | ( *(_t114 + 0x4c) & 0x00000001) != 0x00000000);
						_t196 =  *0x505e6c; // 0x50c83c
						_t26 = _t196 + 0x274; // 0x0
						E0047BFC0( *_t162, 1,  *_t26,  *(_t114 + 0x4c) & 0x00000001);
						_push(_t210);
						_push(0x500305);
						_push( *[fs:eax]);
						 *[fs:eax] = _t211;
						E004DFE14(_t162,  *_t26, _t206, _t207);
						_v32 = E004AADD4(1, 1, 0, 2);
						_push(_t210);
						_push(0x5002eb);
						_push( *[fs:eax]);
						 *[fs:eax] = _t211;
						while(E004AB074(_v32) == 0) {
							E004AB084(_v32, _t162,  &_v16, _t206, _t207, __eflags);
							_t207 = _v16;
							__eflags = _t207;
							if(_t207 != 0) {
								_t208 = _t207 - 4;
								__eflags = _t208;
								_t207 =  *_t208;
							}
							__eflags = _t207 - 4;
							if(_t207 <= 4) {
								_t162 = 0;
								__eflags = 0;
							} else {
								__eflags =  *_v16 - 0x5b;
								_t162 = _t162 & 0xffffff00 |  *_v16 == 0x0000005b;
							}
							__eflags = _t162;
							if(__eflags != 0) {
								__eflags =  *((short*)(_v16 + 6)) - 0x5d;
								if(__eflags == 0) {
									E00406BEC(_v16, _t162, 5, _t206, _t207,  &_v20);
									_t132 = _v16;
									__eflags =  *((short*)(_t132 + 4)) - 0x71;
									if( *((short*)(_t132 + 4)) == 0x71) {
										L21:
										_t133 = 1;
									} else {
										__eflags = _v21;
										if(_v21 == 0) {
											L20:
											_t133 = 0;
										} else {
											_t152 =  *0x505ccc; // 0x50d05c
											__eflags =  *_t152;
											if( *_t152 == 0) {
												goto L21;
											} else {
												goto L20;
											}
										}
									}
									_v22 = _t133;
									_push(_t210);
									_push(0x500262);
									_push( *[fs:eax]);
									 *[fs:eax] = _t211;
									_t137 = ( *(_v16 + 2) & 0x0000ffff) - 0x53;
									__eflags = _t137;
									if(_t137 == 0) {
										_push(_v22 & 0x000000ff);
										E004B3690(0, _t162, _v20, 1, _t206, _t207, _t220);
									} else {
										_t142 = _t137 - 1;
										__eflags = _t142;
										if(_t142 == 0) {
											__eflags = 0;
											E004B3880(0, _t162, _v20, _t207, 0, _t220);
										} else {
											_t145 = _t142 - 0x1f;
											__eflags = _t145;
											if(_t145 == 0) {
												_push(_v22 & 0x000000ff);
												E004B3690(0, _t162, _v20, 0, _t206, _t207, _t220);
											} else {
												__eflags = _t145 - 1;
												if(__eflags == 0) {
													E004B1CE8(_v20, _t162, _t207);
												}
											}
										}
									}
									_pop(_t203);
									 *[fs:eax] = _t203;
								}
							}
						}
						_pop(_t200);
						 *[fs:eax] = _t200;
						_push(E005002F2);
						return E00404098(_v32);
					}
				}
			}

0x004fffd0
0x004fffd0
0x004fffd0
0x004fffd1
0x004fffd3
0x004fffd8
0x004fffd8
0x004fffda
0x004fffdc
0x004fffdc
0x004fffe0
0x004fffe1
0x004fffe2
0x004fffea
0x004fffeb
0x004ffff0
0x004ffff3
0x004ffffe
0x0050000b
0x00500010
0x00500012
0x00500022
0x00500034
0x00500036
0x0050037c
0x0050037e
0x00500381
0x00500384
0x00500391
0x005003a3
0x0050003c
0x0050003c
0x00000000
0x0050003c
0x00500014
0x00500014
0x00500040
0x00500047
0x00500057
0x0050005c
0x0050006f
0x0050007d
0x00500086
0x00500088
0x0050008a
0x005000a3
0x00500088
0x005000b3
0x005000ba
0x005000bb
0x005000c0
0x005000c3
0x005000c6
0x005000cb
0x005000d0
0x005000db
0x005000e5
0x005000f5
0x00500104
0x00500315
0x00500323
0x0050032a
0x00500330
0x00500333
0x00500336
0x0050033d
0x00500340
0x00500351
0x00500354
0x00500357
0x0050035c
0x00500360
0x00500366
0x00000000
0x0050036f
0x00500374
0x0050010a
0x00500111
0x00500116
0x00500122
0x00500127
0x0050012d
0x00500135
0x0050013c
0x0050013d
0x00500142
0x00500145
0x00500148
0x00500162
0x00500167
0x00500168
0x0050016d
0x00500170
0x005002c5
0x0050017e
0x00500183
0x00500186
0x00500188
0x0050018a
0x0050018a
0x0050018d
0x0050018d
0x0050018f
0x00500192
0x005001a0
0x005001a0
0x00500194
0x00500197
0x0050019b
0x0050019b
0x005001a2
0x005001a4
0x005001ad
0x005001b2
0x005001c9
0x005001ce
0x005001d1
0x005001d6
0x005001ec
0x005001ec
0x005001d8
0x005001d8
0x005001dc
0x005001e8
0x005001e8
0x005001de
0x005001de
0x005001e3
0x005001e6
0x00000000
0x00000000
0x00000000
0x00000000
0x005001e6
0x005001dc
0x005001ee
0x005001f3
0x005001f4
0x005001f9
0x005001fc
0x00500206
0x00500206
0x0050020a
0x00500235
0x0050023d
0x0050020c
0x0050020c
0x0050020c
0x0050020f
0x00500251
0x00500253
0x00500211
0x00500211
0x00500211
0x00500215
0x00500222
0x0050022a
0x00500217
0x00500217
0x0050021a
0x00500247
0x00500247
0x0050021a
0x00500215
0x0050020f
0x0050025a
0x0050025d
0x0050025d
0x005001b2
0x005001a4
0x005002d7
0x005002da
0x005002dd
0x005002ea
0x005002ea
0x00500104

APIs

ShowWindow.USER32(?,00000005,00000000,005003A4,?,?,00000000,?,00000000,00000000,?,00500852,00000000,0050085C,?,00000000), ref: 00500057
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,005003A4,?,?,00000000,?,00000000,00000000), ref: 0050007D
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,005003A4), ref: 0050009E
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,005003A4,?,?,00000000,?,00000000), ref: 005000B3

Part of subcall function 0047F334: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,0047F3CB,?,?,?,00000001,?,004B109E,00000000,004B110B), ref: 0047F369

Strings

.msg, xrefs: 005000D6
.lst, xrefs: 005000F0
/REG, xrefs: 00500006
Setup, xrefs: 00500042
/REGU, xrefs: 0050002A
S&P, xrefs: 005000C6, 005000D0
Inno-Setup-RegSvr-Mutex, xrefs: 00500061

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ShowWindow$FileModuleMultipleNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$S&P$Setup
API String ID: 66301061-1680853185
Opcode ID: a638728a3ed6da32e75fe95759ebbf03f6d45d35819781e6fb3aa67088bd9630
Instruction ID: 06a05ccf2ffb956b5e3931f7d49079042011b4337a1749933ce1934425abcd7d
Opcode Fuzzy Hash: a638728a3ed6da32e75fe95759ebbf03f6d45d35819781e6fb3aa67088bd9630
Instruction Fuzzy Hash: E191F330A042459FDB11EBA5CC56BAE7BF4FF49308F51487AF904AB2D2C678AD05CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004B6384, Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 214
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004B6384(char __eax, void* __ebx, signed char __edx, void* __edi, void* __esi, void* __fp0, char _a4, char _a8, intOrPtr _a12) {
				char _v5;
				char _v6;
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v60;
				void* __ecx;
				char _t65;
				void* _t69;
				void* _t112;
				signed char _t135;
				intOrPtr _t137;
				intOrPtr _t164;
				intOrPtr _t178;
				void* _t188;
				signed int _t189;
				char _t191;
				intOrPtr _t193;
				intOrPtr _t194;

				_t210 = __fp0;
				_t187 = __edi;
				_t193 = _t194;
				_t137 = 6;
				do {
					_push(0);
					_push(0);
					_t137 = _t137 - 1;
				} while (_t137 != 0);
				_push(_t137);
				_t1 =  &_v8;
				_t138 =  *_t1;
				 *_t1 = _t137;
				_push(__edi);
				_v5 =  *_t1;
				_t135 = __edx;
				_t191 = __eax;
				_push(_t193);
				_push(0x4b6644);
				_push( *[fs:eax]);
				 *[fs:eax] = _t194;
				_v6 = 1;
				E0047E860(__eax,  *_t1,  &_v12);
				if(E0040C2BC(_v12,  *_t1, L".hlp") != 0) {
					E0047E860(_t191, _t138,  &_v24);
					_t65 = E0040C2BC(_v24, _t138, L".chm");
					__eflags = _t65;
					if(_t65 == 0) {
						E0047E418(_t191, _t135,  &_v28, L".chw", __edi, _t191);
						__eflags = 0;
						E004B6384(_v28, _t135, _t135, __edi, _t191, __fp0, 0, 0, _a12);
						_pop(_t138);
					}
				} else {
					E0047E418(_t191, _t135,  &_v16, L".gid", __edi, _t191);
					E004B6384(_v16, _t135, _t135, __edi, _t191, __fp0, 0, 0, _a12);
					E0047E418(_t191, _t135,  &_v20, L".fts", __edi, _t191);
					E004B6384(_v20, _t135, _t135, _t187, _t191, __fp0, 0, 0, _a12);
					_pop(_t138);
				}
				E0047E860(_t191, _t138,  &_v32);
				_t69 = E0040C2BC(_v32, _t138, L".lnk");
				_t197 = _t69;
				if(_t69 == 0) {
					E004B2000(_t191, _t135);
				}
				if(E004AD944(_t135, _t191, _t197) == 0) {
					L25:
					_pop(_t164);
					 *[fs:eax] = _t164;
					_push(E004B664B);
					L00406440( &_v60, 5);
					return L00406440( &_v32, 6);
				} else {
					_v40 = _t191;
					_v36 = 0x11;
					_t141 = 0;
					E004B31B8(L"Deleting file: %s", _t135, 0,  &_v40, _t187, _t191);
					_t199 = _a4;
					if(_a4 != 0) {
						_t189 = E004AD680(_t135, _t191, _t199);
						if(_t189 != 0xffffffff) {
							_t201 = _t189 & 0x00000001;
							if((_t189 & 0x00000001) != 0) {
								_t141 = _t189 & 0xfffffffe;
								_t112 = E004ADA2C(_t135, _t189 & 0xfffffffe, _t191, _t201);
								_t202 = _t112;
								if(_t112 == 0) {
									E004B2F34(L"Failed to strip read-only attribute.", _t135, _t141, _t189, _t191);
								} else {
									E004B2F34(L"Stripped read-only attribute.", _t135, _t141, _t189, _t191);
								}
							}
						}
					}
					if(E004AD4A8(_t135, _t191, _t202) != 0) {
						__eflags = _v5;
						if(_v5 != 0) {
							SHChangeNotify(4, 5, E004064D4(_t191), 0);
							E0047E804(_t191, _t141,  &_v60);
							E004B135C( *((intOrPtr*)(_a12 - 0x3c)), _t141, _v60, _t210);
						}
						goto L25;
					} else {
						_t188 = GetLastError();
						if(_a8 == 0 ||  *((char*)(_a12 - 0x29)) == 0) {
							L22:
							_v40 = _t188;
							_v36 = 0;
							E004B31B8(L"Failed to delete the file; it may be in use (%d).", _t135, 0,  &_v40, _t188, _t191);
							_v6 = 0;
							goto L25;
						} else {
							if(_t188 == 5) {
								L20:
								if((E004AD680(_t135, _t191, _t207) & 0x00000001) != 0) {
									goto L22;
								}
								_v40 = _t188;
								_v36 = 0;
								E004B31B8(L"The file appears to be in use (%d). Will delete on restart.", _t135, 0,  &_v40, _t188, _t191);
								_push(_t193);
								 *[fs:eax] = _t194;
								E004AE954(_t135, _t135, _t191, _t188, _t191);
								 *((char*)( *((intOrPtr*)(_a12 - 0x30)) + 0x1c)) = 1;
								E0047E754(_t191,  &_v48,  *[fs:eax]);
								E0047E804(_v48, 0,  &_v44);
								E004B135C( *((intOrPtr*)(_a12 + (_t135 & 0x000000ff) * 4 - 0x38)), _a12, _v44, _t210);
								_t178 = 0x4b659f;
								 *[fs:eax] = _t178;
								goto L25;
							}
							_t207 = _t188 - 0x20;
							if(_t188 != 0x20) {
								goto L22;
							}
							goto L20;
						}
					}
				}
			}

0x004b6384
0x004b6384
0x004b6385
0x004b6388
0x004b638d
0x004b638d
0x004b638f
0x004b6391
0x004b6391
0x004b6394
0x004b6395
0x004b6395
0x004b6395
0x004b639a
0x004b639b
0x004b639e
0x004b63a0
0x004b63a4
0x004b63a5
0x004b63aa
0x004b63ad
0x004b63b0
0x004b63b9
0x004b63cd
0x004b641e
0x004b642b
0x004b6430
0x004b6432
0x004b6446
0x004b644e
0x004b6452
0x004b6457
0x004b6457
0x004b63cf
0x004b63e1
0x004b63ed
0x004b6405
0x004b6411
0x004b6416
0x004b6416
0x004b645d
0x004b646a
0x004b646f
0x004b6471
0x004b6475
0x004b6475
0x004b6485
0x004b661c
0x004b661e
0x004b6621
0x004b6624
0x004b6631
0x004b6643
0x004b648b
0x004b648b
0x004b648e
0x004b6495
0x004b649c
0x004b64a1
0x004b64a5
0x004b64b0
0x004b64b5
0x004b64b7
0x004b64bd
0x004b64c1
0x004b64c8
0x004b64cd
0x004b64cf
0x004b64e2
0x004b64d1
0x004b64d6
0x004b64d6
0x004b64cf
0x004b64bd
0x004b64b5
0x004b64f2
0x004b65eb
0x004b65ef
0x004b65ff
0x004b6609
0x004b6617
0x004b6617
0x00000000
0x004b64f8
0x004b64fd
0x004b6503
0x004b65cf
0x004b65cf
0x004b65d2
0x004b65e0
0x004b65e5
0x00000000
0x004b6516
0x004b6519
0x004b6524
0x004b652f
0x00000000
0x00000000
0x004b6535
0x004b6538
0x004b6546
0x004b654d
0x004b6556
0x004b655f
0x004b656a
0x004b6573
0x004b657e
0x004b6590
0x004b6597
0x004b659a
0x00000000
0x004b659a
0x004b651b
0x004b651e
0x00000000
0x00000000
0x00000000
0x004b651e
0x004b6503
0x004b64f2

APIs

GetLastError.KERNEL32(00000000,004B6644,?,?,?,?,00000005,00000000,00000000,?,?,004B7A1D,00000000,00000000,?,00000000), ref: 004B64F8

Strings

Stripped read-only attribute., xrefs: 004B64D1
.chm, xrefs: 004B6426
Failed to strip read-only attribute., xrefs: 004B64DD
Failed to delete the file; it may be in use (%d)., xrefs: 004B65DB
.fts, xrefs: 004B63FE
The file appears to be in use (%d). Will delete on restart., xrefs: 004B6541
.gid, xrefs: 004B63DA
.lnk, xrefs: 004B6465
.chw, xrefs: 004B643F
.hlp, xrefs: 004B63C1
Deleting file: %s, xrefs: 004B6497

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: 21e970eb03c5f9bb93cc2999a3bfae23d6ea034646086abcea4e0956b4f3fdda
Instruction ID: 1d5cb29261c062cca2efc952e041e2ae209f5e2fe3d9a367353128f010f99e71
Opcode Fuzzy Hash: 21e970eb03c5f9bb93cc2999a3bfae23d6ea034646086abcea4e0956b4f3fdda
Instruction Fuzzy Hash: 7D71AD70B002445BDB14EB6AC842BEE77A59F48708F16846BF805AB386DA7CDD05C77E

Uniqueness

Uniqueness Score: -1.00%

Function 004B8DE4, Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 174
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E004B8DE4(intOrPtr __eax, struct _SID_IDENTIFIER_AUTHORITY* __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				_Unknown_base(*)()* _v20;
				_Unknown_base(*)()* _v24;
				char _v28;
				char _v32;
				void* _v36;
				intOrPtr _v40;
				void* _v44;
				intOrPtr* _t67;
				signed int _t107;
				struct _SID_IDENTIFIER_AUTHORITY* _t111;
				void* _t113;
				intOrPtr _t124;
				intOrPtr* _t133;
				void* _t135;
				void* _t136;
				struct HINSTANCE__* _t139;
				struct _SID_IDENTIFIER_AUTHORITY* _t140;
				void* _t142;
				void* _t144;
				intOrPtr _t145;

				_t142 = _t144;
				_t145 = _t144 + 0xffffffd8;
				_t111 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_t67 =  *0x50605c; // 0x503914
				if( *_t67 != 2 || (GetVersion() & 0x000000ff) < 5) {
					_v16 = 1;
					goto L18;
				} else {
					_t139 = GetModuleHandleW(L"advapi32.dll");
					_t133 = GetProcAddress(_t139, "GetNamedSecurityInfoW");
					_v20 = GetProcAddress(_t139, "SetNamedSecurityInfoW");
					_v24 = GetProcAddress(_t139, "SetEntriesInAclW");
					if(_t133 == 0 || _v20 == 0 || _v24 == 0) {
						_v16 = 0x7f;
						goto L18;
					} else {
						_v40 = 0;
						_v16 =  *_t133(E004064D4(_v12), _v8, 4, 0, 0,  &_v32, 0,  &_v28);
						if(_v16 != 0) {
							L18:
							return _v16;
						} else {
							_push(_t142);
							_push(0x4b901f);
							_push( *[fs:edx]);
							 *[fs:edx] = _t145;
							_v40 = E00403000(_a8 << 5);
							_t140 = _t111;
							_t135 = _a8 - 1;
							if(_t135 < 0) {
								L15:
								_v16 = _v24(_a8, _v40, _v32,  &_v36);
								if(_v16 == 0) {
									 *[fs:eax] = _t145;
									_v16 = _v20(E004064D4(_v12), _v8, 4, 0, 0, _v36, 0,  *[fs:eax], 0x4b8fc5, _t142);
									_pop(_t124);
									 *[fs:eax] = _t124;
									_push(0x4b8fcc);
									return LocalFree(_v36);
								} else {
									E00404B68();
									goto L18;
								}
							} else {
								_t136 = _t135 + 1;
								_t113 = 0;
								while(AllocateAndInitializeSid(_t140,  *(_t140 + 6) & 0x000000ff,  *(_t140 + 8),  *(_t140 + 0xc), 0, 0, 0, 0, 0, 0,  &_v44) != 0) {
									_t107 = _t113 + _t113 + _t113 + _t113;
									 *((intOrPtr*)(_v40 + _t107 * 8)) =  *((intOrPtr*)(_t140 + 0x10));
									 *((intOrPtr*)(_v40 + 4 + _t107 * 8)) = 1;
									 *((intOrPtr*)(_v40 + 8 + _t107 * 8)) = _a4;
									 *((intOrPtr*)(_v40 + 0x14 + _t107 * 8)) = 0;
									 *((intOrPtr*)(_v40 + 0x18 + _t107 * 8)) = 0;
									 *((intOrPtr*)(_v40 + 0x1c + _t107 * 8)) = _v44;
									_t140 = _t140 + 0x14;
									_t113 = _t113 + 1;
									_t136 = _t136 - 1;
									if(_t136 != 0) {
										continue;
									} else {
										goto L15;
									}
									goto L19;
								}
								_v16 = GetLastError();
								if(_v16 == 0) {
									_v16 = 0x57;
								}
								E00404B68();
								goto L18;
							}
						}
					}
				}
				L19:
			}

0x004b8de5
0x004b8de7
0x004b8ded
0x004b8def
0x004b8df2
0x004b8df5
0x004b8dfd
0x004b8e0f
0x00000000
0x004b8e1b
0x004b8e25
0x004b8e32
0x004b8e3f
0x004b8e4d
0x004b8e52
0x004b8e60
0x00000000
0x004b8e6c
0x004b8e6e
0x004b8e90
0x004b8e97
0x004b9026
0x004b902f
0x004b8e9d
0x004b8e9f
0x004b8ea0
0x004b8ea5
0x004b8ea8
0x004b8eb6
0x004b8eb9
0x004b8ebe
0x004b8ec1
0x004b8f5b
0x004b8f6e
0x004b8f75
0x004b8f8c
0x004b8fab
0x004b8fb0
0x004b8fb3
0x004b8fb6
0x004b8fc4
0x004b8f77
0x004b8f77
0x00000000
0x004b8f77
0x004b8ec7
0x004b8ec7
0x004b8ec8
0x004b8eca
0x004b8f14
0x004b8f1c
0x004b8f22
0x004b8f30
0x004b8f39
0x004b8f42
0x004b8f4c
0x004b8f50
0x004b8f53
0x004b8f54
0x004b8f55
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004b8f55
0x004b8ef6
0x004b8efd
0x004b8eff
0x004b8eff
0x004b8f06
0x00000000
0x004b8f06
0x004b8ec1
0x004b8e97
0x004b8e52
0x00000000

APIs

GetVersion.KERNEL32 ref: 004B8DFF
GetModuleHandleW.KERNEL32(advapi32.dll), ref: 004B8E20
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW,advapi32.dll), ref: 004B8E2D
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW,00000000,GetNamedSecurityInfoW,advapi32.dll), ref: 004B8E3A
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW,00000000,SetNamedSecurityInfoW,00000000,GetNamedSecurityInfoW,advapi32.dll), ref: 004B8E48
AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,004B901F), ref: 004B8EE8
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,004B901F), ref: 004B8EF1
LocalFree.KERNEL32(?,004B8FCC), ref: 004B8FBF

Strings

SetEntriesInAclW, xrefs: 004B8E42
advapi32.dll, xrefs: 004B8E1B
GetNamedSecurityInfoW, xrefs: 004B8E27
SetNamedSecurityInfoW, xrefs: 004B8E34
W, xrefs: 004B8EFF

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocateErrorFreeHandleInitializeLastLocalModuleVersion
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 4088882585-4263478283
Opcode ID: b569b0da8924b75b6d928f7e28267cb5274795af301fca4db5d4ffd1888432c6
Instruction ID: 5da7fd04ddf4c6fa45d233809ef5dfd02bd567772ee707147d18cc8f297e3b65
Opcode Fuzzy Hash: b569b0da8924b75b6d928f7e28267cb5274795af301fca4db5d4ffd1888432c6
Instruction Fuzzy Hash: A5510B71A00208AFDB10DFA9C845BEEB7F8EB48314F24846AE515F7281D7799E41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00435390, Relevance: 22.8, APIs: 15, Instructions: 253
windowCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00435390(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, signed int _a4) {
				intOrPtr _v8;
				struct HPALETTE__* _v12;
				char _v13;
				struct tagPOINT _v24;
				struct HDC__* _v28;
				void* _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				struct HPALETTE__* _t96;
				signed int _t102;
				signed int _t103;
				signed int _t104;
				char _t105;
				void* _t170;
				intOrPtr* _t200;
				intOrPtr _t214;
				intOrPtr _t216;
				intOrPtr* _t220;
				intOrPtr _t222;
				void* _t224;
				void* _t225;
				intOrPtr _t226;

				_t201 = __ecx;
				_t224 = _t225;
				_t226 = _t225 + 0xffffffe0;
				_t220 = __ecx;
				_v8 = __edx;
				_t200 = __eax;
				_t222 =  *((intOrPtr*)(__eax + 0x28));
				E004326C8(_v8, __ecx,  *0x435648 & 0x000000ff, __ecx);
				E00435CDC(_t200);
				_v12 = 0;
				_v13 = 0;
				_t96 =  *(_t222 + 0x10);
				if(_t96 != 0) {
					_v12 = SelectPalette( *(_v8 + 4), _t96, 0xffffffff);
					RealizePalette( *(_v8 + 4));
					_v13 = 1;
				}
				_push(GetDeviceCaps( *(_v8 + 4), 0xc));
				_t102 = GetDeviceCaps( *(_v8 + 4), 0xe);
				_pop(_t103);
				_t104 = _t103 * _t102;
				if(_t104 > 8) {
					L4:
					_t105 = 0;
				} else {
					_t201 =  *(_t222 + 0x28) & 0x0000ffff;
					if(_t104 < ( *(_t222 + 0x2a) & 0x0000ffff) * ( *(_t222 + 0x28) & 0x0000ffff)) {
						_t105 = 1;
					} else {
						goto L4;
					}
				}
				if(_t105 == 0) {
					if(E00435788(_t200) == 0) {
						SetStretchBltMode(E004325EC(_v8), 3);
					}
				} else {
					GetBrushOrgEx( *(_v8 + 4),  &_v24);
					SetStretchBltMode( *(_v8 + 4), 4);
					SetBrushOrgEx( *(_v8 + 4), _v24, _v24.y,  &_v24);
				}
				_push(_t224);
				_push(0x435637);
				_push( *[fs:eax]);
				 *[fs:eax] = _t226;
				if( *((intOrPtr*)( *_t200 + 0x2c))() != 0) {
					E00435C7C(_t200, _t201);
				}
				E004326C8(E004356CC(_t200), _t201,  *0x435648 & 0x000000ff, _t220);
				if( *((intOrPtr*)( *_t200 + 0x2c))() == 0) {
					if( *((short*)(_t222 + 0x3e)) != 0x20) {
						_v36 = 0;
						_v35 = 0;
						_v34 = _a4 & 0x000000ff;
						_v33 = 0;
						_push(_v36);
						_push( *((intOrPtr*)(_t222 + 0x20)));
						_push( *((intOrPtr*)(_t222 + 0x1c)));
						_push(0);
						_push(0);
						_push( *((intOrPtr*)(E004356CC(_t200) + 4)));
						_push( *((intOrPtr*)(_t220 + 0xc)) -  *((intOrPtr*)(_t220 + 4)));
						_push( *((intOrPtr*)(_t220 + 8)) -  *_t220);
						_push( *((intOrPtr*)(_t220 + 4)));
						_push( *_t220);
						_push(E004325EC(_v8));
						L004098E4();
					} else {
						_v36 = 0;
						_v35 = 0;
						_v34 = _a4 & 0x000000ff;
						_v33 = 1;
						_push(_v36);
						_push( *((intOrPtr*)(_t222 + 0x20)));
						_push( *((intOrPtr*)(_t222 + 0x1c)));
						_push(0);
						_push(0);
						_push( *((intOrPtr*)(E004356CC(_t200) + 4)));
						_push( *((intOrPtr*)(_t220 + 0xc)) -  *((intOrPtr*)(_t220 + 4)));
						_push( *((intOrPtr*)(_t220 + 8)) -  *_t220);
						_push( *((intOrPtr*)(_t220 + 4)));
						_push( *_t220);
						_push(E004325EC(_v8));
						L004098E4();
					}
					_pop(_t214);
					 *[fs:eax] = _t214;
					_push(0x43563e);
					if(_v13 != 0) {
						return SelectPalette( *(_v8 + 4), _v12, 0xffffffff);
					}
					return 0;
				} else {
					_v32 = 0;
					_v28 = 0;
					_push(_t224);
					_push(0x435563);
					_push( *[fs:eax]);
					 *[fs:eax] = _t226;
					_v28 = E004329E4(CreateCompatibleDC(0));
					_v32 = SelectObject(_v28,  *(_t222 + 0xc));
					E00432B94( *(_v8 + 4), _t200,  *((intOrPtr*)(_t220 + 4)),  *_t220, _t220, _t222, 0, 0, _v28,  *((intOrPtr*)(_t222 + 0x20)),  *((intOrPtr*)(_t222 + 0x1c)), 0, 0,  *((intOrPtr*)(E004356CC(_t200) + 4)),  *((intOrPtr*)(_t220 + 0xc)) -  *((intOrPtr*)(_t220 + 4)),  *((intOrPtr*)(_t220 + 8)) -  *_t220);
					_t170 = 0;
					_pop(_t216);
					 *[fs:eax] = _t216;
					_push(0x435611);
					if(_v32 != 0) {
						_t170 = SelectObject(_v28, _v32);
					}
					if(_v28 != 0) {
						return DeleteDC(_v28);
					}
					return _t170;
				}
			}

0x00435390
0x00435391
0x00435393
0x00435399
0x0043539b
0x0043539e
0x004353a0
0x004353ad
0x004353b4
0x004353bb
0x004353be
0x004353c2
0x004353c7
0x004353d8
0x004353e2
0x004353e7
0x004353e7
0x004353f9
0x00435403
0x0043540a
0x0043540b
0x00435410
0x00435421
0x00435421
0x00435412
0x00435416
0x0043541f
0x00435425
0x00000000
0x00000000
0x00000000
0x0043541f
0x00435429
0x0043546c
0x00435479
0x00435479
0x0043542b
0x00435436
0x00435444
0x0043545c
0x0043545c
0x00435480
0x00435481
0x00435486
0x00435489
0x00435495
0x00435499
0x00435499
0x004354ac
0x004354ba
0x0043556f
0x004355c2
0x004355c6
0x004355ce
0x004355d1
0x004355d5
0x004355db
0x004355df
0x004355e0
0x004355e2
0x004355ee
0x004355f5
0x004355fb
0x004355ff
0x00435602
0x0043560b
0x0043560c
0x00435571
0x00435571
0x00435575
0x0043557d
0x00435580
0x00435584
0x0043558a
0x0043558e
0x0043558f
0x00435591
0x0043559d
0x004355a4
0x004355aa
0x004355ae
0x004355b1
0x004355ba
0x004355bb
0x004355bb
0x00435613
0x00435616
0x00435619
0x00435622
0x00000000
0x00435631
0x00435636
0x004354c0
0x004354c2
0x004354c7
0x004354cc
0x004354cd
0x004354d2
0x004354d5
0x004354e4
0x004354f4
0x0043552e
0x00435533
0x00435535
0x00435538
0x0043553b
0x00435544
0x0043554e
0x0043554e
0x00435557
0x00000000
0x0043555d
0x00435562
0x00435562

APIs

Part of subcall function 00435CDC: GetDC.USER32(00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D32
Part of subcall function 00435CDC: GetDeviceCaps.GDI32(00000000,0000000C,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D47
Part of subcall function 00435CDC: GetDeviceCaps.GDI32(00000000,0000000E,00000000,0000000C,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D51
Part of subcall function 00435CDC: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D75
Part of subcall function 00435CDC: ReleaseDC.USER32(00000000,00000000,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D80

SelectPalette.GDI32(?,?,000000FF), ref: 004353D3
RealizePalette.GDI32(?,?,?,000000FF), ref: 004353E2
GetDeviceCaps.GDI32(?,0000000C), ref: 004353F4
GetDeviceCaps.GDI32(?,0000000E,00000000,?,0000000C), ref: 00435403
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 00435436
SetStretchBltMode.GDI32(?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 00435444
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 0043545C
SetStretchBltMode.GDI32(00000000,00000003,0000000E,00000000,?,0000000C), ref: 00435479
CreateCompatibleDC.GDI32(00000000,00000000,00435563,?,?,0000000E,00000000,?,0000000C), ref: 004354DA
SelectObject.GDI32(?,?,00000000,00000000,00435563,?,?,0000000E,00000000,?,0000000C), ref: 004354EF
SelectObject.GDI32(?,00000000,00435611,?,?,00000000,00000000,?,?,?,?,?,00000000,00000000,00435563), ref: 0043554E
DeleteDC.GDI32(00000000,00435611,?,?,00000000,00000000,?,?,?,?,?,00000000,00000000,00435563), ref: 0043555D

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: ec61dfdd96fde0580eae5dcae36290f5e6b043ea516ba4f01daebca7ac20028c
Instruction ID: f89c35122393f8e14a8a6f7ae8d703e9313bef097aa6b949de13be502db41b9c
Opcode Fuzzy Hash: ec61dfdd96fde0580eae5dcae36290f5e6b043ea516ba4f01daebca7ac20028c
Instruction Fuzzy Hash: B4913AB1600645AFDB10DBADC986F5EBBF8AF0C304F14955AF548E7292D678ED00CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004350E4, Relevance: 22.8, APIs: 15, Instructions: 252
windowCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E004350E4(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				struct HPALETTE__* _v12;
				char _v13;
				struct tagPOINT _v24;
				struct HDC__* _v28;
				void* _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				struct HPALETTE__* _t92;
				signed int _t98;
				signed int _t99;
				signed int _t100;
				char _t101;
				void* _t169;
				intOrPtr* _t199;
				intOrPtr _t214;
				intOrPtr _t216;
				int* _t220;
				intOrPtr _t222;
				void* _t224;
				void* _t225;
				intOrPtr _t226;

				_t200 = __ecx;
				_t224 = _t225;
				_t226 = _t225 + 0xffffffe0;
				_t220 = __ecx;
				_v8 = __edx;
				_t199 = __eax;
				_t222 =  *((intOrPtr*)(__eax + 0x28));
				E004326C8(_v8, __ecx,  *0x43538c & 0x000000ff, __ecx);
				E00435CDC(_t199);
				_v12 = 0;
				_v13 = 0;
				_t92 =  *(_t222 + 0x10);
				if(_t92 != 0) {
					_v12 = SelectPalette( *(_v8 + 4), _t92, 0xffffffff);
					RealizePalette( *(_v8 + 4));
					_v13 = 1;
				}
				_push(GetDeviceCaps( *(_v8 + 4), 0xc));
				_t98 = GetDeviceCaps( *(_v8 + 4), 0xe);
				_pop(_t99);
				_t100 = _t99 * _t98;
				if(_t100 > 8) {
					L4:
					_t101 = 0;
				} else {
					_t200 =  *(_t222 + 0x28) & 0x0000ffff;
					if(_t100 < ( *(_t222 + 0x2a) & 0x0000ffff) * ( *(_t222 + 0x28) & 0x0000ffff)) {
						_t101 = 1;
					} else {
						goto L4;
					}
				}
				if(_t101 == 0) {
					if(E00435788(_t199) == 0) {
						SetStretchBltMode(E004325EC(_v8), 3);
					}
				} else {
					GetBrushOrgEx( *(_v8 + 4),  &_v24);
					SetStretchBltMode( *(_v8 + 4), 4);
					SetBrushOrgEx( *(_v8 + 4), _v24, _v24.y,  &_v24);
				}
				_push(_t224);
				_push(0x43537b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t226;
				if( *((intOrPtr*)( *_t199 + 0x2c))() != 0) {
					E00435C7C(_t199, _t200);
				}
				E004326C8(E004356CC(_t199), _t200,  *0x43538c & 0x000000ff, _t220);
				if( *((intOrPtr*)( *_t199 + 0x2c))() == 0) {
					if( *((intOrPtr*)( *_t199 + 0x4c))() == 0) {
						StretchBlt( *(_v8 + 4),  *_t220, _t220[1], _t220[2] -  *_t220, _t220[3] - _t220[1],  *(E004356CC(_t199) + 4), 0, 0,  *(_t222 + 0x1c),  *(_t222 + 0x20),  *(_v8 + 0x20));
					} else {
						_v36 = 0;
						_v35 = 0;
						_v34 = 0xff;
						_v33 = 1;
						_push(_v36);
						_push( *(_t222 + 0x20));
						_push( *(_t222 + 0x1c));
						_push(0);
						_push(0);
						_push( *(E004356CC(_t199) + 4));
						_push(_t220[3] - _t220[1]);
						_push(_t220[2] -  *_t220);
						_push(_t220[1]);
						_push( *_t220);
						_push(E004325EC(_v8));
						L004098E4();
					}
					_pop(_t214);
					 *[fs:eax] = _t214;
					_push(0x435382);
					if(_v13 != 0) {
						return SelectPalette( *(_v8 + 4), _v12, 0xffffffff);
					}
					return 0;
				} else {
					_v32 = 0;
					_v28 = 0;
					_push(_t224);
					_push(0x4352b7);
					_push( *[fs:eax]);
					 *[fs:eax] = _t226;
					_v28 = E004329E4(CreateCompatibleDC(0));
					_v32 = SelectObject(_v28,  *(_t222 + 0xc));
					E00432B94( *(_v8 + 4), _t199, _t220[1],  *_t220, _t220, _t222, 0, 0, _v28,  *(_t222 + 0x20),  *(_t222 + 0x1c), 0, 0,  *(E004356CC(_t199) + 4), _t220[3] - _t220[1], _t220[2] -  *_t220);
					_t169 = 0;
					_pop(_t216);
					 *[fs:eax] = _t216;
					_push(0x435355);
					if(_v32 != 0) {
						_t169 = SelectObject(_v28, _v32);
					}
					if(_v28 != 0) {
						return DeleteDC(_v28);
					}
					return _t169;
				}
			}

0x004350e4
0x004350e5
0x004350e7
0x004350ed
0x004350ef
0x004350f2
0x004350f4
0x00435101
0x00435108
0x0043510f
0x00435112
0x00435116
0x0043511b
0x0043512c
0x00435136
0x0043513b
0x0043513b
0x0043514d
0x00435157
0x0043515e
0x0043515f
0x00435164
0x00435175
0x00435175
0x00435166
0x0043516a
0x00435173
0x00435179
0x00000000
0x00000000
0x00000000
0x00435173
0x0043517d
0x004351c0
0x004351cd
0x004351cd
0x0043517f
0x0043518a
0x00435198
0x004351b0
0x004351b0
0x004351d4
0x004351d5
0x004351da
0x004351dd
0x004351e9
0x004351ed
0x004351ed
0x00435200
0x0043520e
0x004352c7
0x00435350
0x004352c9
0x004352c9
0x004352cd
0x004352d1
0x004352d5
0x004352d9
0x004352df
0x004352e3
0x004352e4
0x004352e6
0x004352f2
0x004352f9
0x004352ff
0x00435303
0x00435306
0x0043530f
0x00435310
0x00435310
0x00435357
0x0043535a
0x0043535d
0x00435366
0x00000000
0x00435375
0x0043537a
0x00435214
0x00435216
0x0043521b
0x00435220
0x00435221
0x00435226
0x00435229
0x00435238
0x00435248
0x00435282
0x00435287
0x00435289
0x0043528c
0x0043528f
0x00435298
0x004352a2
0x004352a2
0x004352ab
0x00000000
0x004352b1
0x004352b6
0x004352b6

APIs

Part of subcall function 00435CDC: GetDC.USER32(00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D32
Part of subcall function 00435CDC: GetDeviceCaps.GDI32(00000000,0000000C,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D47
Part of subcall function 00435CDC: GetDeviceCaps.GDI32(00000000,0000000E,00000000,0000000C,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D51
Part of subcall function 00435CDC: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D75
Part of subcall function 00435CDC: ReleaseDC.USER32(00000000,00000000,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D80

SelectPalette.GDI32(?,?,000000FF), ref: 00435127
RealizePalette.GDI32(?,?,?,000000FF), ref: 00435136
GetDeviceCaps.GDI32(?,0000000C), ref: 00435148
GetDeviceCaps.GDI32(?,0000000E,00000000,?,0000000C), ref: 00435157
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 0043518A
SetStretchBltMode.GDI32(?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 00435198
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 004351B0
SetStretchBltMode.GDI32(00000000,00000003,0000000E,00000000,?,0000000C), ref: 004351CD
CreateCompatibleDC.GDI32(00000000,00000000,004352B7,?,?,0000000E,00000000,?,0000000C), ref: 0043522E
SelectObject.GDI32(?,?,00000000,00000000,004352B7,?,?,0000000E,00000000,?,0000000C), ref: 00435243
SelectObject.GDI32(?,00000000,00435355,?,?,00000000,00000000,?,?,?,?,?,00000000,00000000,004352B7), ref: 004352A2
DeleteDC.GDI32(00000000,00435355,?,?,00000000,00000000,?,?,?,?,?,00000000,00000000,004352B7), ref: 004352B1

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: 0b2384828f6ef36602e99a3ee6c31fc4d7a522f9daae9738aa0fa33658e9da1d
Instruction ID: ecfa6789a9eab1f9ee6a0eaf4a00f4e58f4ca257da603540a977f8fada1563ab
Opcode Fuzzy Hash: 0b2384828f6ef36602e99a3ee6c31fc4d7a522f9daae9738aa0fa33658e9da1d
Instruction Fuzzy Hash: 079127B1A00605AFDB10DBADC985F5EB7F8AF0C304F14956AB518E7392D678ED008B68

Uniqueness

Uniqueness Score: -1.00%

Function 004B4CD4, Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 162
registryCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E004B4CD4(signed int __eax, void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _v5;
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* __ecx;
				void* _t79;
				signed int _t83;
				signed char _t125;
				intOrPtr _t127;
				intOrPtr _t156;
				signed int _t170;
				intOrPtr _t178;
				intOrPtr _t180;
				intOrPtr _t181;

				_t180 = _t181;
				_t127 = 4;
				do {
					_push(0);
					_push(0);
					_t127 = _t127 - 1;
				} while (_t127 != 0);
				_t1 =  &_v8;
				_t128 =  *_t1;
				 *_t1 = _t127;
				_t178 =  *_t1;
				_v5 = __edx;
				_t125 = __eax;
				_push(_t180);
				_push(0x4b4edd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t181;
				if( *((intOrPtr*)(0x50cc74 + ((__eax & 0x000000ff) + (__eax & 0x000000ff)) * 8 + (_v5 & 0x000000ff) * 4)) != 0) {
					L18:
					E00406448(_t178,  *((intOrPtr*)(0x50cc74 + ((_t125 & 0x000000ff) + (_t125 & 0x000000ff)) * 8 + (_v5 & 0x000000ff) * 4)));
					_pop(_t156);
					 *[fs:eax] = _t156;
					_push(E004B4EE4);
					return L00406440( &_v32, 5);
				}
				E004B4B80(__eax, _t128,  &_v16, _t180);
				if((_v5 & 0x000000ff) + 0xfe - 2 >= 0 || E0047FDB8(_t125, L"SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v4.0", 0x80000002,  &_v12, 1, 0) != 0) {
					_t79 = (_v5 & 0x000000ff) - 1;
					if(_t79 == 0 || _t79 == 2) {
						if(E0047FDB8(_t125, L"SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v2.0", 0x80000002,  &_v12, 1, 0) != 0) {
							goto L10;
						} else {
							_t24 =  &_v24; // 0x4b6f6a
							_t174 = _t125 & 0x0000007f;
							E0047E328( *((intOrPtr*)(0x50cc68 + (_t125 & 0x0000007f) * 4)), _t24);
							_t27 =  &_v24; // 0x4b6f6a
							E00406914(0x50cc74 + (_t174 + _t174) * 8 + (_v5 & 0x000000ff) * 4, L"v2.0.50727",  *_t27);
							RegCloseKey(_v12);
							goto L14;
						}
					} else {
						L10:
						_t83 = _v5 & 0x000000ff;
						if(_t83 == 0 || _t83 == 3) {
							if(E0047FDB8(_t125, L"SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v1.1", 0x80000002,  &_v12, 1, 0) == 0) {
								_t172 = _t125 & 0x0000007f;
								E0047E328( *((intOrPtr*)(0x50cc68 + (_t125 & 0x0000007f) * 4)),  &_v28);
								E00406914(0x50cc74 + (_t172 + _t172) * 8 + (_v5 & 0x000000ff) * 4, L"v1.1.4322", _v28);
								RegCloseKey(_v12);
							}
						}
						goto L14;
					}
				} else {
					_t176 = _t125 & 0x0000007f;
					E0047E328( *((intOrPtr*)(0x50cc68 + (_t125 & 0x0000007f) * 4)),  &_v20);
					E00406914(0x50cc74 + (_t176 + _t176) * 8 + (_v5 & 0x000000ff) * 4, L"v4.0.30319", _v20);
					RegCloseKey(_v12);
					L14:
					_t170 = _v5 & 0x000000ff;
					if( *((intOrPtr*)(0x50cc74 + ((_t125 & 0x000000ff) + (_t125 & 0x000000ff)) * 8 + _t170 * 4)) == 0) {
						if(_v5 == 3) {
							E004ADE4C(L".NET Framework not found", _t125);
						} else {
							_v40 =  *((intOrPtr*)(0x50538c + _t170 * 4));
							_v36 = 0x11;
							E0040E2C8(L".NET Framework version %s not found", 0,  &_v40,  &_v32);
							E004ADE4C(_v32, _t125);
						}
					}
					goto L18;
				}
			}

0x004b4cd5
0x004b4cd8
0x004b4cdd
0x004b4cdd
0x004b4cdf
0x004b4ce1
0x004b4ce1
0x004b4ce4
0x004b4ce4
0x004b4ce4
0x004b4cea
0x004b4cec
0x004b4cef
0x004b4cf3
0x004b4cf4
0x004b4cf9
0x004b4cfc
0x004b4d13
0x004b4ea8
0x004b4ebd
0x004b4ec4
0x004b4ec7
0x004b4eca
0x004b4edc
0x004b4edc
0x004b4d1e
0x004b4d2b
0x004b4d8f
0x004b4d91
0x004b4db2
0x00000000
0x004b4db4
0x004b4db4
0x004b4db9
0x004b4dc3
0x004b4dc8
0x004b4de2
0x004b4deb
0x00000000
0x004b4deb
0x004b4df2
0x004b4df2
0x004b4df2
0x004b4df8
0x004b4e19
0x004b4e20
0x004b4e2a
0x004b4e49
0x004b4e52
0x004b4e52
0x004b4e19
0x00000000
0x004b4df8
0x004b4d4a
0x004b4d4f
0x004b4d59
0x004b4d78
0x004b4d81
0x004b4e57
0x004b4e57
0x004b4e6b
0x004b4e71
0x004b4ea3
0x004b4e73
0x004b4e7e
0x004b4e81
0x004b4e8f
0x004b4e97
0x004b4e97
0x004b4e71
0x00000000
0x004b4e6b

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,004B4EDD,?,004B4B6C,?,00000000,00000000,00000000,?,?,004B5148,00000000), ref: 004B4D81
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,004B4EDD,?,004B4B6C,?,00000000,00000000,00000000,?,?,004B5148,00000000), ref: 004B4DEB
RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,00000001,00000000,00000000,004B4EDD,?,004B4B6C,?,00000000,00000000,00000000,?), ref: 004B4E52

Strings

v1.1.4322, xrefs: 004B4E44
v2.0.50727, xrefs: 004B4DDD
joK, xrefs: 004B4DB4, 004B4DC8
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 004B4D9F
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 004B4E06
v4.0.30319, xrefs: 004B4D73
.NET Framework version %s not found, xrefs: 004B4E8A
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 004B4D35
.NET Framework not found, xrefs: 004B4E9E

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Close
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$joK$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 3535843008-2318238563
Opcode ID: a2fef0e54704a53305d93c17240945cb0e7a9e5dc4198d48ea80958f77403ca2
Instruction ID: fb6ec15dd2429ba791411b9cb07e0705bd1e520aacc4cee53212024aecf4aec9
Opcode Fuzzy Hash: a2fef0e54704a53305d93c17240945cb0e7a9e5dc4198d48ea80958f77403ca2
Instruction Fuzzy Hash: 2551F230A042445BDB04DB65C861BFE77BAEB86304F14456FE541AB282C73DAE19DB38

Uniqueness

Uniqueness Score: -1.00%

Function 004329F4, Relevance: 21.1, APIs: 14, Instructions: 131
windowCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004329F4(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _v8;
				int _v12;
				int _v16;
				struct HBITMAP__* _v20;
				struct HDC__* _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				int _v48;
				int _v52;
				void _v56;
				void* _t78;
				intOrPtr _t85;
				intOrPtr _t86;
				void* _t91;
				void* _t93;
				void* _t94;
				intOrPtr _t95;

				_t93 = _t94;
				_t95 = _t94 + 0xffffffcc;
				asm("movsd");
				asm("movsd");
				_t77 = __ecx;
				_v8 = __eax;
				_v28 = CreateCompatibleDC(0);
				_v32 = CreateCompatibleDC(0);
				_push(_t93);
				_push(0x432b42);
				_push( *[fs:eax]);
				 *[fs:eax] = _t95;
				GetObjectW(_v8, 0x18,  &_v56);
				if(__ecx == 0) {
					_v24 = GetDC(0);
					if(_v24 == 0) {
						E0043293C(_t77);
					}
					_push(_t93);
					_push(0x432ab1);
					_push( *[fs:eax]);
					 *[fs:eax] = _t95;
					_v20 = CreateCompatibleBitmap(_v24, _v16, _v12);
					if(_v20 == 0) {
						E0043293C(_t77);
					}
					_pop(_t85);
					 *[fs:eax] = _t85;
					_push(0x432ab8);
					return ReleaseDC(0, _v24);
				} else {
					_v20 = CreateBitmap(_v16, _v12, 1, 1, 0);
					if(_v20 != 0) {
						_t78 = SelectObject(_v28, _v8);
						_t91 = SelectObject(_v32, _v20);
						StretchBlt(_v32, 0, 0, _v16, _v12, _v28, 0, 0, _v52, _v48, 0xcc0020);
						if(_t78 != 0) {
							SelectObject(_v28, _t78);
						}
						if(_t91 != 0) {
							SelectObject(_v32, _t91);
						}
					}
					_pop(_t86);
					 *[fs:eax] = _t86;
					_push(0x432b49);
					DeleteDC(_v28);
					return DeleteDC(_v32);
				}
			}

0x004329f5
0x004329f7
0x00432a02
0x00432a03
0x00432a04
0x00432a06
0x00432a10
0x00432a1a
0x00432a1f
0x00432a20
0x00432a25
0x00432a28
0x00432a35
0x00432a3c
0x00432a5d
0x00432a64
0x00432a66
0x00432a66
0x00432a6d
0x00432a6e
0x00432a73
0x00432a76
0x00432a8a
0x00432a91
0x00432a93
0x00432a93
0x00432a9a
0x00432a9d
0x00432aa0
0x00432ab0
0x00432a3e
0x00432a51
0x00432abc
0x00432acb
0x00432ada
0x00432b01
0x00432b08
0x00432b0f
0x00432b0f
0x00432b16
0x00432b1d
0x00432b1d
0x00432b16
0x00432b24
0x00432b27
0x00432b2a
0x00432b33
0x00432b41
0x00432b41

APIs

CreateCompatibleDC.GDI32(00000000), ref: 00432A0B
CreateCompatibleDC.GDI32(00000000,00000000), ref: 00432A15
GetObjectW.GDI32(?,00000018,?,00000000,00432B42,?,00000000,00000000), ref: 00432A35
CreateBitmap.GDI32(?,?,00000001,00000001,00000000,?,00000018,?,00000000,00432B42,?,00000000,00000000), ref: 00432A4C
GetDC.USER32(00000000,?,00000018,?,00000000,00432B42,?,00000000,00000000), ref: 00432A58
CreateCompatibleBitmap.GDI32(00000000,?,?,00000000,00432AB1,?,00000000,?,00000018,?,00000000,00432B42,?,00000000,00000000), ref: 00432A85
ReleaseDC.USER32(00000000,00000000,00432AB8,00000000,00432AB1,?,00000000,?,00000018,?,00000000,00432B42,?,00000000,00000000), ref: 00432AAB
SelectObject.GDI32(?,?,?,?,00000001,00000001,00000000,?,00000018,?,00000000,00432B42,?,00000000,00000000), ref: 00432AC6
SelectObject.GDI32(?,00000000,?,?,?,?,00000001,00000001,00000000,?,00000018,?,00000000,00432B42,?,00000000), ref: 00432AD5
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020,?,00000000,?,?,?), ref: 00432B01
SelectObject.GDI32(?,00000000,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020,?,00000000,?), ref: 00432B0F
SelectObject.GDI32(?,00000000,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020,?,00000000,?), ref: 00432B1D
DeleteDC.GDI32(?,00432B49,00000001,00000000,?,00000018,?,00000000,00432B42,?,00000000,00000000), ref: 00432B33
DeleteDC.GDI32(?,?,00432B49,00000001,00000000,?,00000018,?,00000000,00432B42,?,00000000,00000000), ref: 00432B3C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 42a73b7d00687ef1f96489ee635fcd442223beb98c845625f38f8eff694f1120
Instruction ID: 25d32b5350c85e97df0d1ca10d4ec1bdff61e429144fe7edc8bfd465d7ef9a27
Opcode Fuzzy Hash: 42a73b7d00687ef1f96489ee635fcd442223beb98c845625f38f8eff694f1120
Instruction Fuzzy Hash: 3241D171E44249AFDB10EAE9C942FAFB7FCEB0C704F514426B614F7292D6B85D008B64

Uniqueness

Uniqueness Score: -1.00%

Function 00464B00, Relevance: 19.7, APIs: 13, Instructions: 248
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00464B00(intOrPtr* __eax, intOrPtr __edx, void* __fp0) {
				intOrPtr* _v8;
				intOrPtr _v12;
				struct HDC__* _v16;
				int _v20;
				int _v24;
				struct tagPOINT _v32;
				struct tagRECT _v48;
				signed int _v60;
				signed int _v64;
				struct HRGN__* _t166;
				signed int _t191;
				intOrPtr* _t198;
				intOrPtr* _t201;
				intOrPtr _t208;
				signed int _t211;
				intOrPtr _t248;
				signed int _t251;
				void* _t266;
				void* _t269;
				void* _t271;
				intOrPtr _t272;
				void* _t296;

				_t296 = __fp0;
				_t269 = _t271;
				_t272 = _t271 + 0xffffffc4;
				_v12 = __edx;
				_v8 = __eax;
				if( *(_v8 + 0x1a9) != 0 ||  *(_v8 + 0x1b0) > 0) {
					_v16 = GetWindowDC(E00463AA8(_v8));
					_push(_t269);
					_push(0x464dab);
					_push( *[fs:ecx]);
					 *[fs:ecx] = _t272;
					GetClientRect(E00463AA8(_v8),  &_v32);
					GetWindowRect(E00463AA8(_v8),  &_v48);
					MapWindowPoints(0, E00463AA8(_v8),  &_v48, 2);
					E00409254( &_v32,  ~(_v48.top),  ~(_v48.left));
					ExcludeClipRect(_v16, _v32, _v32.y, _v24, _v20);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					InflateRect( &_v32,  *(_v8 + 0x1b0),  *(_v8 + 0x1b0));
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t211 = GetWindowLongW(E00463AA8(_v8), 0xfffffff0);
					if((_t211 & 0x00200000) != 0) {
						_t201 =  *0x505bec; // 0x50beb0
						_v48.right = _v48.right +  *((intOrPtr*)( *_t201))(0x14);
					}
					if((_t211 & 0x00100000) != 0) {
						_t198 =  *0x505bec; // 0x50beb0
						_v48.bottom = _v48.bottom +  *((intOrPtr*)( *_t198))(0x15);
					}
					if( *(_v8 + 0x1a9) != 0) {
						_t266 = 0;
						_t251 =  *(_v8 + 0x1a7) & 0x000000ff;
						if(_t251 != 0) {
							_t266 = 0 +  *((intOrPtr*)(_v8 + 0x1ac));
						}
						_t191 =  *(_v8 + 0x1a8) & 0x000000ff;
						if(_t191 != 0) {
							_t266 = _t266 +  *((intOrPtr*)(_v8 + 0x1ac));
						}
						if(( *(_v8 + 0x1a6) & 0x00000001) != 0) {
							_v48.left = _v48.left - _t266;
						}
						if(( *(_v8 + 0x1a6) & 0x00000002) != 0) {
							_v48.top = _v48.top - _t266;
						}
						if(( *(_v8 + 0x1a6) & 0x00000004) != 0) {
							_v48.right = _v48.right + _t266;
						}
						if(( *(_v8 + 0x1a6) & 0x00000008) != 0) {
							_v48.bottom = _v48.bottom + _t266;
						}
						DrawEdge(_v16,  &_v48,  *(0x504b84 + (_t251 & 0x0000007f) * 4) |  *(0x504b94 + (_t191 & 0x0000007f) * 4),  *(_v8 + 0x1a6) & 0x000000ff |  *(0x504ba4 + ( *(_v8 + 0x1a9) & 0x000000ff) * 4) |  *(0x504bb4 + ( *(_v8 + 0x1e1) & 0x000000ff) * 4) | 0x00002000);
					}
					IntersectClipRect(_v16, _v48.left, _v48.top, _v48.right, _v48.bottom);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t166 =  *(_v12 + 4);
					if(_t166 != 1) {
						GetRgnBox(_t166,  &_v32);
						MapWindowPoints(0, E00463AA8(_v8),  &_v32, 2);
						E004091DC( &_v48,  &_v32,  &_v48, _t296);
						E00409254( &_v48,  ~_v60,  ~_v64);
					} else {
						E00409254( &_v48,  ~(_v48.top),  ~_v48);
					}
					FillRect(_v16,  &_v48, E004317A4( *((intOrPtr*)(_v8 + 0x1b8))));
					_pop(_t248);
					 *[fs:eax] = _t248;
					_push(0x464db2);
					return ReleaseDC(E00463AA8(_v8), _v16);
				} else {
					 *((intOrPtr*)( *_v8 - 0x10))();
					_t208 = E0046B920(_v8,  *_v8, _v12);
					if(_t208 != 0) {
						_t208 = _v8;
						if(( *(_t208 + 0x52) & 0x00000002) != 0) {
							_t208 = E0046B7A0(E0046AF6C(), 0, _v8);
						}
					}
					return _t208;
				}
			}

0x00464b00
0x00464b01
0x00464b03
0x00464b09
0x00464b0c
0x00464b19
0x00464b39
0x00464b3e
0x00464b3f
0x00464b44
0x00464b47
0x00464b57
0x00464b69
0x00464b7f
0x00464b91
0x00464baa
0x00464bb5
0x00464bb6
0x00464bb7
0x00464bb8
0x00464bc8
0x00464bd3
0x00464bd4
0x00464bd5
0x00464bd6
0x00464be7
0x00464bef
0x00464bf3
0x00464bfc
0x00464bfc
0x00464c05
0x00464c09
0x00464c12
0x00464c12
0x00464c1f
0x00464c25
0x00464c2a
0x00464c33
0x00464c3e
0x00464c3e
0x00464c43
0x00464c4c
0x00464c57
0x00464c57
0x00464c63
0x00464c65
0x00464c65
0x00464c72
0x00464c74
0x00464c74
0x00464c81
0x00464c83
0x00464c83
0x00464c90
0x00464c92
0x00464c92
0x00464ce5
0x00464ce5
0x00464cfe
0x00464d09
0x00464d0a
0x00464d0b
0x00464d0c
0x00464d10
0x00464d16
0x00464d34
0x00464d4a
0x00464d58
0x00464d6a
0x00464d18
0x00464d25
0x00464d25
0x00464d86
0x00464d8d
0x00464d90
0x00464d93
0x00464daa
0x00464db2
0x00464dba
0x00464dc0
0x00464dc7
0x00464dc9
0x00464dd0
0x00464ddc
0x00464ddc
0x00464dd0
0x00464de7
0x00464de7

APIs

GetWindowDC.USER32(00000000), ref: 00464B34
GetClientRect.USER32(00000000,?,00000000,00464DAB,?,00000000), ref: 00464B57
GetWindowRect.USER32(00000000,?,00000000,?,00000000,00464DAB,?,00000000), ref: 00464B69
MapWindowPoints.USER32(00000000,00000000,?,00000002,00000000,?,00000000,?,00000000,00464DAB,?,00000000), ref: 00464B7F
ExcludeClipRect.GDI32(?,?,?,?,?,00000000,00000000,?,00000002,00000000,?,00000000,?,00000000,00464DAB), ref: 00464BAA
InflateRect.USER32(?,00000000,00000000,?,?,?,?,?,00000000,00000000,?,00000002,00000000,?,00000000,?), ref: 00464BC8
GetWindowLongW.USER32(00000000,000000F0,?,00000000,00000000,?,?,?,?,?,00000000,00000000,?,00000002,00000000,?), ref: 00464BE2
DrawEdge.USER32(?,?,?,00000008,00000000,000000F0,?,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00464CE5
IntersectClipRect.GDI32(?,?,?,?,?,00000000,000000F0,?,00000000,00000000,?,?,?,?,?,00000000), ref: 00464CFE
GetRgnBox.GDI32(?,?,?,?,?,?,?,00000000,000000F0,?,00000000,00000000,?,?,?,?), ref: 00464D34
MapWindowPoints.USER32(00000000,00000000,?,00000002,?,?,?,?,?,?,?,00000000,000000F0,?,00000000,00000000), ref: 00464D4A
FillRect.USER32(?,?,00000000,00000000,00000000,?,00000002,?,?,?,?,?,?,?,00000000,000000F0), ref: 00464D86
ReleaseDC.USER32(00000000,?,00464DB2,00000000,00000000,?,00000002,?,?,?,?,?,?,?,00000000,000000F0), ref: 00464DA5

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$Window$ClipPoints$ClientDrawEdgeExcludeFillInflateIntersectLongRelease
String ID:
API String ID: 2031318930-0
Opcode ID: 3e25f0f46c90b52c3850a0da3fa9956733cb2c88a6898b071dc8b5d6c2f4cd5d
Instruction ID: 0d4b8695ac97b192710cd5a374f9e25d4827d323f7dd6930468e8ce6b50502b3
Opcode Fuzzy Hash: 3e25f0f46c90b52c3850a0da3fa9956733cb2c88a6898b071dc8b5d6c2f4cd5d
Instruction Fuzzy Hash: 2BA13971E00148AFCF00DBA8C885EDEB7F9AF49304F1440AAF555BB292D738AE05DB65

Uniqueness

Uniqueness Score: -1.00%

Function 004AF584, Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 253
registryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E004AF584(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				intOrPtr _v12;
				char _v13;
				void* _v20;
				char _v21;
				char _v28;
				int _v32;
				int _v36;
				char _v40;
				char _v44;
				char* _v48;
				char _v52;
				char _v56;
				char _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				char* _v72;
				char _v76;
				char _v80;
				void* _t77;
				char _t98;
				char _t103;
				char* _t110;
				char _t133;
				char _t139;
				char _t144;
				void* _t168;
				short* _t169;
				char _t170;
				char _t172;
				intOrPtr _t189;
				intOrPtr _t194;
				intOrPtr _t196;
				void* _t207;
				void* _t208;
				intOrPtr _t209;

				_t207 = _t208;
				_t209 = _t208 + 0xffffffb4;
				_push(__edi);
				_v40 = 0;
				_v44 = 0;
				_v60 = 0;
				_v76 = 0;
				_v80 = 0;
				_v56 = 0;
				_v8 = 0;
				_v12 = __edx;
				_push(_t207);
				_push(0x4af866);
				_push( *[fs:edx]);
				 *[fs:edx] = _t209;
				_v13 = 0;
				_t168 = E0047FDB8(_t77, L"Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs", 0x80000002,  &_v20, 3, 0);
				if(_t168 == 2) {
					L30:
					_pop(_t189);
					 *[fs:eax] = _t189;
					_push(E004AF86D);
					L00406440( &_v80, 2);
					L00406440( &_v60, 2);
					L00406440( &_v44, 2);
					return L00406438( &_v8);
				} else {
					if(_t168 != 0) {
						E004AE0AC(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs",  &_v56);
						_v52 = _v56;
						_v48 = L"Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs";
						E004ABE78(0x44, 1,  &_v52,  &_v44);
						_push(_v44);
						_push(L"\r\n\r\n");
						_v72 = L"RegOpenKeyEx";
						E0040CFC0( &_v76);
						_v68 = _v76;
						E00480914(_t168,  &_v80);
						_v64 = _v80;
						E004ABE78(0x3b, 2,  &_v72,  &_v60);
						_push(_v60);
						E004069F8( &_v40, 3, __edi);
						E004119A0(_v40, 1);
						E00404A74();
					}
					_push(_t207);
					_push(0x4af822);
					_push( *[fs:eax]);
					 *[fs:eax] = _t209;
					_t169 = E004064D4(_v12);
					if(RegQueryValueExW(_v20, _t169, 0,  &_v32, 0,  &_v36) == 0) {
						_v21 = 0;
						_v28 = 0;
						_push(_t207);
						_push(0x4af760);
						_push( *[fs:eax]);
						 *[fs:eax] = _t209;
						_t98 = _v32 - 1;
						__eflags = _t98;
						if(_t98 == 0) {
							__eflags = E0047FCE0();
							if(__eflags != 0) {
								_v28 = E0040D21C(_v8, __eflags);
								_v21 = 1;
							}
						} else {
							_t133 = _t98 - 2;
							__eflags = _t133;
							if(_t133 == 0) {
								__eflags = _v36 - 1;
								if(_v36 >= 1) {
									__eflags = _v36 - 4;
									if(_v36 <= 4) {
										_t139 = RegQueryValueExW(_v20, E004064D4(_v12), 0, 0,  &_v28,  &_v36);
										__eflags = _t139;
										if(_t139 == 0) {
											_v21 = 1;
										}
									}
								}
							} else {
								__eflags = _t133 == 1;
								if(_t133 == 1) {
									_v36 = 4;
									_t144 = RegQueryValueExW(_v20, _t169, 0, 0,  &_v28,  &_v36);
									__eflags = _t144;
									if(_t144 == 0) {
										_v21 = 1;
									}
								}
							}
						}
						_pop(_t194);
						 *[fs:eax] = _t194;
						__eflags = _v21;
						if(_v21 != 0) {
							_v28 = _v28 - 1;
							__eflags = _v28;
							if(_v28 > 0) {
								_t103 = _v32 - 1;
								__eflags = _t103;
								if(_t103 == 0) {
									_push(0);
									E0040D1CC( &_v8, _v28);
									_t170 = _v8;
									__eflags = _t170;
									if(_t170 != 0) {
										_t172 = _t170 - 4;
										__eflags = _t172;
										_t170 =  *_t172;
									}
									_t110 = E004064D4(_v8);
									RegSetValueExW(_v20, E004064D4(_v12), 0, 1, _t110, _t170 + 1 + _t170 + 1);
								} else {
									__eflags = _t103 + 0xfffffffe - 2;
									if(_t103 + 0xfffffffe - 2 < 0) {
										RegSetValueExW(_v20, E004064D4(_v12), 0, _v32,  &_v28, 4);
									}
								}
							} else {
								_v13 = 1;
								RegDeleteValueW(_v20, E004064D4(_v12));
							}
							__eflags = 0;
							_pop(_t196);
							 *[fs:eax] = _t196;
							_push(E004AF829);
							return RegCloseKey(_v20);
						} else {
							E00404B68();
							goto L30;
						}
					} else {
						E00404B68();
						goto L30;
					}
				}
			}

0x004af585
0x004af587
0x004af58c
0x004af58f
0x004af592
0x004af595
0x004af598
0x004af59b
0x004af59e
0x004af5a1
0x004af5a4
0x004af5a9
0x004af5aa
0x004af5af
0x004af5b2
0x004af5b5
0x004af5d0
0x004af5d5
0x004af829
0x004af82b
0x004af82e
0x004af831
0x004af83e
0x004af84b
0x004af858
0x004af865
0x004af5db
0x004af5dd
0x004af5ef
0x004af5f7
0x004af5ff
0x004af60c
0x004af611
0x004af614
0x004af622
0x004af62a
0x004af632
0x004af63a
0x004af642
0x004af64f
0x004af654
0x004af65f
0x004af66e
0x004af673
0x004af673
0x004af67a
0x004af67b
0x004af680
0x004af683
0x004af69a
0x004af6a8
0x004af6b4
0x004af6ba
0x004af6bf
0x004af6c0
0x004af6c5
0x004af6c8
0x004af6ce
0x004af6ce
0x004af6cf
0x004af6e8
0x004af6ea
0x004af6f4
0x004af6f7
0x004af6f7
0x004af6d1
0x004af6d1
0x004af6d1
0x004af6d4
0x004af6fd
0x004af701
0x004af703
0x004af707
0x004af722
0x004af727
0x004af729
0x004af72b
0x004af72b
0x004af729
0x004af707
0x004af6d6
0x004af6d6
0x004af6d7
0x004af731
0x004af749
0x004af74e
0x004af750
0x004af752
0x004af752
0x004af750
0x004af6d7
0x004af6d4
0x004af758
0x004af75b
0x004af76a
0x004af76e
0x004af77a
0x004af77d
0x004af781
0x004af79e
0x004af79e
0x004af79f
0x004af7b0
0x004af7b5
0x004af7ba
0x004af7bd
0x004af7bf
0x004af7c1
0x004af7c1
0x004af7c4
0x004af7c4
0x004af7cf
0x004af7e6
0x004af7a1
0x004af7a4
0x004af7a7
0x004af806
0x004af806
0x004af7a7
0x004af783
0x004af783
0x004af794
0x004af794
0x004af80b
0x004af80d
0x004af810
0x004af813
0x004af821
0x004af770
0x004af770
0x00000000
0x004af770
0x004af6aa
0x004af6aa
0x00000000
0x004af6aa
0x004af6a8

APIs

Part of subcall function 0047FDB8: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,0048048E,?,00000000,?,0048042E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0048048E), ref: 0047FDD4

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,00000000,004AF822,?,?,00000003,00000000,00000000,004AF866), ref: 004AF6A1

Part of subcall function 00480914: FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,004AACCA,00000000,004AAD1B,?,004AAEFC), ref: 00480933

RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000004,00000000,004AF760,?,?,00000000,00000000,?,00000000,?,00000000), ref: 004AF722
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000004,00000000,004AF760,?,?,00000000,00000000,?,00000000,?,00000000), ref: 004AF749

Strings

RegOpenKeyEx, xrefs: 004AF61D
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004AF5FA
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004AF5C1
, xrefs: 004AF614

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: f5cf1ee929a787fc106d466861a1d5fd44ec5386cc98083130a573f7aa025553
Instruction ID: 150e44b6411f86017b075d792a5f5a15f4c27b9f7b04420629c56426e76b7d04
Opcode Fuzzy Hash: f5cf1ee929a787fc106d466861a1d5fd44ec5386cc98083130a573f7aa025553
Instruction Fuzzy Hash: A9913275A04209AFDB10EBE5C881BEEB7B9EB59304F10443BF505F7281D738A9498B69

Uniqueness

Uniqueness Score: -1.00%

Function 004B3FA4, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70
sleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004B3FA4(intOrPtr __eax, void* __edx) {
				long _v12;
				long _v16;
				void* __ebx;
				void* __esi;
				void* _t44;
				void* _t50;
				intOrPtr _t51;
				DWORD* _t52;

				_t19 = __eax;
				_t52 =  &_v12;
				_t44 = __edx;
				_t51 = __eax;
				if( *((char*)(__eax + 4)) == 0) {
					L11:
					return _t19;
				}
				 *((char*)(__eax + 5)) = 1;
				_v16 =  *((intOrPtr*)(__eax + 0x10));
				_v12 = 0;
				E004B31B8(L"Stopping 64-bit helper process. (PID: %u)", __edx, 0,  &_v16, _t50, __eax);
				CloseHandle( *(_t51 + 0xc));
				 *(_t51 + 0xc) = 0;
				while(WaitForSingleObject( *(_t51 + 8), 0x2710) == 0x102) {
					E004B2F34(L"Helper isn\'t responding; killing it.", _t44, 0, _t50, _t51);
					TerminateProcess( *(_t51 + 8), 1);
				}
				if(GetExitCodeProcess( *(_t51 + 8), _t52) == 0) {
					E004B2F34(L"Helper process exited, but failed to get exit code.", _t44, 0, _t50, _t51);
				} else {
					if( *_t52 != 0) {
						_v16 =  *_t52;
						_v12 = 0;
						E004B31B8(L"Helper process exited with failure code: 0x%x", _t44, 0,  &_v16, _t50, _t51);
					} else {
						E004B2F34(L"Helper process exited.", _t44, 0, _t50, _t51);
					}
				}
				CloseHandle( *(_t51 + 8));
				 *(_t51 + 8) = 0;
				_t19 = 0;
				 *((intOrPtr*)(_t51 + 0x10)) = 0;
				 *((char*)(_t51 + 4)) = 0;
				if(_t44 == 0) {
					goto L11;
				} else {
					Sleep(0xfa);
					return 0;
				}
			}

0x004b3fa4
0x004b3fa6
0x004b3fa9
0x004b3fab
0x004b3fb1
0x004b4083
0x004b4083
0x004b4083
0x004b3fb7
0x004b3fbe
0x004b3fc2
0x004b3fd2
0x004b3fdb
0x004b3fe2
0x004b3ffc
0x004b3fec
0x004b3ff7
0x004b3ff7
0x004b401d
0x004b4054
0x004b401f
0x004b4023
0x004b4034
0x004b4038
0x004b4048
0x004b4025
0x004b402a
0x004b402a
0x004b4023
0x004b405d
0x004b4064
0x004b4067
0x004b4069
0x004b406c
0x004b4072
0x00000000
0x004b4074
0x004b4079
0x00000000
0x004b4079

APIs

CloseHandle.KERNEL32(?), ref: 004B3FDB
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 004B3FF7
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 004B4005
GetExitCodeProcess.KERNEL32(?,?,?,00002710,?,00000001,?,00002710,?), ref: 004B4016
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 004B405D
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 004B4079

Strings

Helper process exited with failure code: 0x%x, xrefs: 004B4043
Helper process exited, but failed to get exit code., xrefs: 004B404F
Helper isn't responding; killing it., xrefs: 004B3FE7
Stopping 64-bit helper process. (PID: %u), xrefs: 004B3FCD
Helper process exited., xrefs: 004B4025

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 43296dde228f4e760ad16098a0f136bb63784d8066a3323d19e416172e9ea350
Instruction ID: 2b52f7421bf43ec8076f74f71562daf0dfe10b0b1cb4f40f860c5fc3dc756444
Opcode Fuzzy Hash: 43296dde228f4e760ad16098a0f136bb63784d8066a3323d19e416172e9ea350
Instruction Fuzzy Hash: D6213E70605340AAC720EABE8545B9B76E49B99304F048C2FB599D7292D779E880877A

Uniqueness

Uniqueness Score: -1.00%

Function 0040A17C, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61
windowregistryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A17C(intOrPtr* __eax, int* __edx, intOrPtr* _a4, intOrPtr* _a8) {
				intOrPtr* _v8;
				struct HWND__* _t19;
				int* _t20;
				int* _t26;
				int* _t27;

				_t26 = _t20;
				_t27 = __edx;
				_v8 = __eax;
				_t19 = FindWindowW(L"MouseZ", L"Magellan MSWHEEL");
				 *_v8 = RegisterWindowMessageW(L"MSWHEEL_ROLLMSG");
				 *_t27 = RegisterWindowMessageW(L"MSH_WHEELSUPPORT_MSG");
				 *_t26 = RegisterWindowMessageW(L"MSH_SCROLL_LINES_MSG");
				if( *_t27 == 0 || _t19 == 0) {
					 *_a8 = 0;
				} else {
					 *_a8 = SendMessageW(_t19,  *_t27, 0, 0);
				}
				if( *_t26 == 0 || _t19 == 0) {
					 *_a4 = 3;
				} else {
					 *_a4 = SendMessageW(_t19,  *_t26, 0, 0);
				}
				return _t19;
			}

0x0040a183
0x0040a185
0x0040a187
0x0040a199
0x0040a1a8
0x0040a1b4
0x0040a1c0
0x0040a1c5
0x0040a1e4
0x0040a1cb
0x0040a1db
0x0040a1db
0x0040a1e9
0x0040a206
0x0040a1ef
0x0040a1ff
0x0040a1ff
0x0040a213

APIs

FindWindowW.USER32(MouseZ,Magellan MSWHEEL), ref: 0040A194
RegisterWindowMessageW.USER32(MSWHEEL_ROLLMSG,MouseZ,Magellan MSWHEEL), ref: 0040A1A0
RegisterWindowMessageW.USER32(MSH_WHEELSUPPORT_MSG,MSWHEEL_ROLLMSG,MouseZ,Magellan MSWHEEL), ref: 0040A1AF
RegisterWindowMessageW.USER32(MSH_SCROLL_LINES_MSG,MSH_WHEELSUPPORT_MSG,MSWHEEL_ROLLMSG,MouseZ,Magellan MSWHEEL), ref: 0040A1BB
SendMessageW.USER32(00000000,00000000,00000000,00000000,MSH_SCROLL_LINES_MSG,MSH_WHEELSUPPORT_MSG,MSWHEEL_ROLLMSG,MouseZ,Magellan MSWHEEL), ref: 0040A1D3
SendMessageW.USER32(00000000,?,00000000,00000000,MSH_SCROLL_LINES_MSG,MSH_WHEELSUPPORT_MSG,MSWHEEL_ROLLMSG,MouseZ,Magellan MSWHEEL), ref: 0040A1F7

Strings

MSH_SCROLL_LINES_MSG, xrefs: 0040A1B6
MSH_WHEELSUPPORT_MSG, xrefs: 0040A1AA
MSWHEEL_ROLLMSG, xrefs: 0040A19B
MouseZ, xrefs: 0040A18F
Magellan MSWHEEL, xrefs: 0040A18A

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Window$Register$Send$Find
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 3569030445-3736581797
Opcode ID: 28d09edb0c33a8650baf8b637921eade82828a83bd35bef6175044be0dd813a7
Instruction ID: de916b79933dc1f45b9434af41ef309634a34aa5b2f0f2deb7c1e5ace83fab2d
Opcode Fuzzy Hash: 28d09edb0c33a8650baf8b637921eade82828a83bd35bef6175044be0dd813a7
Instruction Fuzzy Hash: 2A114C70244302AFE7109F65C882B66B7A8EF85714F20447AB844AB3C2E7B95D50CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004AF198, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 238
registryCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E004AF198(void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				long _v8;
				signed int _v9;
				void* _v16;
				char _v20;
				int _v24;
				char _v28;
				int _v32;
				int _v36;
				short* _v40;
				char _v44;
				char _v48;
				char* _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				intOrPtr _v72;
				char* _v76;
				char _v80;
				char _v84;
				void* _t83;
				void* _t84;
				signed int _t94;
				void* _t98;
				void* _t129;
				void* _t134;
				long _t139;
				long _t145;
				long _t170;
				long _t172;
				intOrPtr _t188;
				intOrPtr _t190;
				void* _t204;
				void* _t206;
				void* _t207;
				intOrPtr _t208;

				_t206 = _t207;
				_t208 = _t207 + 0xffffffb0;
				_push(__edi);
				_v44 = 0;
				_v48 = 0;
				_v64 = 0;
				_v80 = 0;
				_v84 = 0;
				_v60 = 0;
				_v8 = 0;
				_v9 = __ecx;
				_t204 = __edx;
				_push(_t206);
				_push(0x4af44d);
				_push( *[fs:edx]);
				 *[fs:edx] = _t208;
				_t84 = E0047FD80(_t83, L"Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs", 0x80000002,  &_v20,  &_v16, 0, 3, 0, 0, 0);
				_t169 = _t84;
				if(_t84 != 0) {
					E004AE0AC(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs",  &_v60);
					_v56 = _v60;
					_v52 = L"Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs";
					E004ABE78(0x44, 1,  &_v56,  &_v48);
					_push(_v48);
					_push(L"\r\n\r\n");
					_v76 = L"RegCreateKeyEx";
					E0040CFC0( &_v80);
					_v72 = _v80;
					E00480914(_t169,  &_v84);
					_v68 = _v84;
					E004ABE78(0x3b, 2,  &_v76,  &_v64);
					_push(_v64);
					E004069F8( &_v44, 3, __edi);
					E004119A0(_v44, 1);
					E00404A74();
				}
				_v40 = E004064D4(_t204);
				_v28 = 0;
				_v36 = 4;
				_push(_t206);
				_push(0x4af373);
				_push( *[fs:eax]);
				 *[fs:eax] = _t208;
				if(RegQueryValueExW(_v16, _v40, 0,  &_v32, 0,  &_v24) == 0) {
					_t129 = _v32 - 1;
					if(_t129 == 0) {
						__eflags = E0047FCE0();
						if(__eflags != 0) {
							_v28 = E0040D21C(_v8, __eflags);
							_v36 = 1;
						}
					} else {
						_t134 = _t129 - 2;
						if(_t134 == 0) {
							__eflags = _v24 - 1;
							if(_v24 >= 1) {
								__eflags = _v24 - 4;
								if(_v24 <= 4) {
									_t139 = RegQueryValueExW(_v16, _v40, 0, 0,  &_v28,  &_v24);
									__eflags = _t139;
									if(_t139 != 0) {
										E0041198C();
									}
									_v36 = 3;
								}
							}
						} else {
							if(_t134 == 1) {
								_v24 = 4;
								_t145 = RegQueryValueExW(_v16, _v40, 0, 0,  &_v28,  &_v24);
								__eflags = _t145;
								if(_t145 != 0) {
									E0041198C();
								}
							}
						}
					}
				}
				_t94 = 0;
				_pop(_t188);
				 *[fs:eax] = _t188;
				if(_v28 < 0) {
					_t94 = 0;
					_v28 = 0;
				}
				if(((_t94 & 0xffffff00 | _v28 == 0x00000000) & _v9) != 0) {
					_v28 = _v28 + 1;
				}
				_v28 = _v28 + 1;
				_t98 = _v36 - 1;
				if(_t98 == 0) {
					_push(0);
					E0040D1CC( &_v8, _v28);
					_t170 = _v8;
					__eflags = _t170;
					if(_t170 != 0) {
						_t172 = _t170 - 4;
						__eflags = _t172;
						_t170 =  *_t172;
					}
					RegSetValueExW(_v16, _v40, 0, _v36, E004064D4(_v8), _t170 + 1 + _t170 + 1);
				} else {
					if(_t98 + 0xfffffffe - 2 < 0) {
						RegSetValueExW(_v16, _v40, 0, _v36,  &_v28, 4);
					}
				}
				RegCloseKey(_v16);
				_pop(_t190);
				 *[fs:eax] = _t190;
				_push(0x4af454);
				L00406440( &_v84, 2);
				L00406440( &_v64, 2);
				L00406440( &_v48, 2);
				return L00406438( &_v8);
			}

0x004af199
0x004af19b
0x004af1a0
0x004af1a3
0x004af1a6
0x004af1a9
0x004af1ac
0x004af1af
0x004af1b2
0x004af1b5
0x004af1b8
0x004af1bb
0x004af1bf
0x004af1c0
0x004af1c5
0x004af1c8
0x004af1e7
0x004af1ec
0x004af1f0
0x004af202
0x004af20a
0x004af212
0x004af21f
0x004af224
0x004af227
0x004af235
0x004af23d
0x004af245
0x004af24d
0x004af255
0x004af262
0x004af267
0x004af272
0x004af281
0x004af286
0x004af286
0x004af292
0x004af297
0x004af29a
0x004af2a3
0x004af2a4
0x004af2a9
0x004af2ac
0x004af2ca
0x004af2d3
0x004af2d4
0x004af2f1
0x004af2f3
0x004af2fd
0x004af300
0x004af300
0x004af2d6
0x004af2d6
0x004af2d9
0x004af309
0x004af30d
0x004af30f
0x004af313
0x004af329
0x004af32e
0x004af330
0x004af332
0x004af332
0x004af337
0x004af337
0x004af313
0x004af2db
0x004af2dc
0x004af340
0x004af35b
0x004af360
0x004af362
0x004af364
0x004af364
0x004af362
0x004af2dc
0x004af2d9
0x004af2d4
0x004af369
0x004af36b
0x004af36e
0x004af386
0x004af388
0x004af38a
0x004af38a
0x004af397
0x004af399
0x004af399
0x004af39c
0x004af3a2
0x004af3a3
0x004af3b4
0x004af3b9
0x004af3be
0x004af3c1
0x004af3c3
0x004af3c5
0x004af3c5
0x004af3c8
0x004af3c8
0x004af3e7
0x004af3a5
0x004af3ab
0x004af402
0x004af402
0x004af3ab
0x004af40b
0x004af412
0x004af415
0x004af418
0x004af425
0x004af432
0x004af43f
0x004af44c

APIs

Part of subcall function 0047FD80: RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0047FDAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004AF373,?,00000000,004AF44D), ref: 004AF2C3
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,?,00000000,00000000,?,00000000,?,00000000,004AF373,?,00000000), ref: 004AF40B

Part of subcall function 00480914: FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,004AACCA,00000000,004AAD1B,?,004AAEFC), ref: 00480933

Strings

RegCreateKeyEx, xrefs: 004AF230
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004AF1DD
, xrefs: 004AF227
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004AF20D

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 93fe75e0dc91c58cdfcdd32e8426371339e91b8656ec1370ec08f0f94419e236
Instruction ID: 9f39d53a5a87b3f62f7469eb147cf787bb2eed81155906607100f5c1a1ea7932
Opcode Fuzzy Hash: 93fe75e0dc91c58cdfcdd32e8426371339e91b8656ec1370ec08f0f94419e236
Instruction Fuzzy Hash: 97910171E00209ABDF10DFE5C881BEEB7B9EB59304F10413AE915F7281D7789A09CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00445954, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00445954(intOrPtr* __eax, void* __ecx, void* __edx) {
				intOrPtr _v8;
				struct tagRECT _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				void* __edi;
				void* __ebp;
				void* _t86;
				intOrPtr* _t151;
				void* _t153;
				intOrPtr _t166;
				void* _t178;
				signed int _t180;
				void* _t183;
				void* _t185;
				void* _t187;
				intOrPtr _t188;

				_t153 = __ecx;
				_t185 = _t187;
				_t188 = _t187 + 0xffffffdc;
				_push(_t178);
				_t151 = __eax;
				_t86 = E004616D4(__eax, __edx, _t178);
				if( *(_t151 + 0x1a9) == 0) {
					return _t86;
				} else {
					_v8 = E004318E0(_t153, 1);
					 *[fs:eax] = _t188;
					E00459928(_v8, _t151);
					 *((intOrPtr*)( *_t151 + 0x44))( *[fs:eax], 0x445b84, _t185);
					E00431750( *((intOrPtr*)(_v8 + 0x14)),  *_t151,  *((intOrPtr*)(_t151 + 0x6c)), _t178, _t185);
					E00431FB0(_v8,  &_v24, _t178);
					InflateRect( &_v24, 0xffffffff, 0xffffffff);
					E00431FB0(_v8,  &_v24, _t178);
					if( *(_t151 + 0x1a9) != 0) {
						if( *(_t151 + 0x1a8) != 0) {
							_t183 = _t183 +  *((intOrPtr*)(_t151 + 0x1ac));
						}
						if(_t183 == 0) {
							 *((intOrPtr*)( *_t151 + 0x44))();
							E00431750( *((intOrPtr*)(_v8 + 0x14)),  *_t151,  *((intOrPtr*)(_t151 + 0x6c)), _t178, _t185);
							E00431FB0(_v8,  &_v24, _t178);
							InflateRect( &_v24, 0xffffffff, 0xffffffff);
							E00431FB0(_v8,  &_v24, _t178);
						}
						E0045AA14(_t151,  &_v40);
						_t180 = GetWindowLongW(E004325EC(_v8), 0xfffffff0);
						if(( *(_t151 + 0x1a6) & 0x00000001) != 0) {
							_v40 = _v40 - _t183;
						}
						if(( *(_t151 + 0x1a6) & 0x00000002) != 0) {
							_v36 = _v36 - _t183;
						}
						if(( *(_t151 + 0x1a6) & 0x00000004) != 0) {
							_v32 = _v32 + _t183;
						}
						if((_t180 & 0x00200000) != 0) {
							_v32 = _v32 + GetSystemMetrics(0x14);
						}
						if(( *(_t151 + 0x1a6) & 0x00000008) != 0) {
							_v28 = _v28 + _t183;
						}
						if((_t180 & 0x00100000) != 0) {
							_v28 = _v28 + GetSystemMetrics(0x15);
						}
						 *((intOrPtr*)( *_t151 + 0x44))();
						DrawEdge(E004325EC(_v8),  &_v24,  *(0x5047d8 + ( *(_t151 + 0x1a7) & 0x000000ff) * 4) |  *(0x5047e8 + ( *(_t151 + 0x1a8) & 0x000000ff) * 4),  *(_t151 + 0x1a6) & 0x000000ff |  *(0x5047f8 + ( *(_t151 + 0x1a9) & 0x000000ff) * 4) |  *(0x504808 + ( *(_t151 + 0x1e1) & 0x000000ff) * 4) | 0x00002000);
						_v24.left = _v24.right - GetSystemMetrics(0xa);
						if( *((char*)(_t151 + 0x2d6)) != 1) {
							if(E00443D80(_t151) == 0) {
								DrawFrameControl(E004325EC(_v8),  &_v24, 3, 0x4005);
							} else {
								DrawFrameControl(E004325EC(_v8),  &_v24, 3, 0x4005);
							}
						}
					}
					_pop(_t166);
					 *[fs:eax] = _t166;
					_push(0x445b8b);
					return E00404098(_v8);
				}
			}

0x00445954
0x00445955
0x00445957
0x0044595c
0x0044595d
0x00445961
0x0044596d
0x00445b91
0x00445973
0x0044597f
0x0044598d
0x00445995
0x004459a1
0x004459ad
0x004459b8
0x004459c5
0x004459d0
0x004459dc
0x004459fc
0x00445a04
0x00445a04
0x00445a08
0x00445a11
0x00445a1d
0x00445a28
0x00445a35
0x00445a40
0x00445a40
0x00445a4a
0x00445a5f
0x00445a68
0x00445a6a
0x00445a6a
0x00445a74
0x00445a76
0x00445a76
0x00445a80
0x00445a82
0x00445a82
0x00445a8b
0x00445a94
0x00445a94
0x00445a9e
0x00445aa0
0x00445aa0
0x00445aa9
0x00445ab2
0x00445ab2
0x00445abc
0x00445b12
0x00445b23
0x00445b2d
0x00445b38
0x00445b69
0x00445b3a
0x00445b4e
0x00445b4e
0x00445b38
0x00445b2d
0x00445b70
0x00445b73
0x00445b76
0x00445b83
0x00445b83

APIs

Part of subcall function 004318E0: InitializeCriticalSection.KERNEL32(00433FAC,00433F70,00000000,00000001,00434106,00000000,?,00000000,004356F1), ref: 00431900

Part of subcall function 00431FB0: FrameRect.USER32(?,?,00000000,?,?,004459BD), ref: 00431FD9

InflateRect.USER32(?,000000FF,000000FF), ref: 004459C5
InflateRect.USER32(?,000000FF,000000FF), ref: 00445A35
GetWindowLongW.USER32(00000000,000000F0,?,000000FF,000000FF), ref: 00445A5A
GetSystemMetrics.USER32(00000014,00000000,000000F0,?,000000FF,000000FF), ref: 00445A8F
GetSystemMetrics.USER32(00000015,00000000,000000F0,?,000000FF,000000FF), ref: 00445AAD
DrawEdge.USER32(00000000,?,00000000,00000008), ref: 00445B12
GetSystemMetrics.USER32(0000000A,00000000,?,00000000,00000008), ref: 00445B19
DrawFrameControl.USER32(00000000,?,00000003,00004005), ref: 00445B4E
DrawFrameControl.USER32(00000000,?,00000003,00004005), ref: 00445B69

Strings

@IE, xrefs: 00445975

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: DrawFrameMetricsRectSystem$ControlInflate$CriticalEdgeInitializeLongSectionWindow
String ID: @IE
API String ID: 1915978996-2832602497
Opcode ID: c02b6f417649646cd4ce542a98cfb0278df72b33b5ef5af8b7ca47780581c30d
Instruction ID: 2c2438684bd4533d24cde3194ded8972ad035deb4bd7444f7ea950fa338f4b42
Opcode Fuzzy Hash: c02b6f417649646cd4ce542a98cfb0278df72b33b5ef5af8b7ca47780581c30d
Instruction Fuzzy Hash: AC618170A04244AFEF01EF69C985BDE77F4AF46304F180276E944AB297D7389E04CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00411828, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00411828(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				char* _v8;
				long _v12;
				short _v140;
				short _v2188;
				void* _t15;
				char* _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t30;
				long _t48;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t61;
				void* _t64;

				_push(__ebx);
				_push(__esi);
				_v8 = 0;
				_push(_t64);
				_push(0x41194d);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t64 + 0xfffff778;
				_t61 = E0041163C(_t15, __ebx,  &_v2188, __edx, __edi, __esi, __fp0, 0x400);
				_t17 =  *0x505ef0; // 0x507054
				if( *_t17 == 0) {
					_t19 =  *0x505b18; // 0x40a50c
					_t11 = _t19 + 4; // 0xffe9
					_t21 =  *0x509b50; // 0x400000
					LoadStringW(E00408118(_t21),  *_t11,  &_v140, 0x40);
					MessageBoxW(0,  &_v2188,  &_v140, 0x2010);
				} else {
					_t30 =  *0x505b9c; // 0x50732c
					E00403180(E00403450(_t30));
					_t48 = WideCharToMultiByte(1, 0,  &_v2188, _t61, 0, 0, 0, 0);
					_push(_t48);
					E00408024();
					WideCharToMultiByte(1, 0,  &_v2188, _t61, _v8, _t48, 0, 0);
					WriteFile(GetStdHandle(0xfffffff4), _v8, _t48,  &_v12, 0);
					WriteFile(GetStdHandle(0xfffffff4), 0x411968, 2,  &_v12, 0);
				}
				_pop(_t56);
				 *[fs:eax] = _t56;
				_push(0x411954);
				_t57 =  *0x411804; // 0x411808
				return E00408030( &_v8, _t57);
			}

0x00411831
0x00411832
0x00411835
0x0041183a
0x0041183b
0x00411840
0x00411843
0x00411856
0x00411858
0x00411860
0x004118fe
0x00411903
0x00411907
0x00411912
0x0041192c
0x00411866
0x00411866
0x00411870
0x0041188e
0x00411890
0x0041189f
0x004118bc
0x004118d4
0x004118ee
0x004118ee
0x00411933
0x00411936
0x00411939
0x00411941
0x0041194c

APIs

Part of subcall function 0041163C: VirtualQuery.KERNEL32(?,?,0000001C,00000000,004117E8), ref: 0041166F
Part of subcall function 0041163C: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00411693
Part of subcall function 0041163C: GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 004116AE
Part of subcall function 0041163C: LoadStringW.USER32(00000000,0000FFE8,?,00000100,00400000,?,00000105), ref: 00411749

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,0041194D), ref: 00411889
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004118BC
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004118CE
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004118D4
GetStdHandle.KERNEL32(000000F4,00411968,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 004118E8
WriteFile.KERNEL32(00000000,000000F4,00411968,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 004118EE
LoadStringW.USER32(00000000,0000FFE9,?,00000040,00000400,00000000,0041194D), ref: 00411912
MessageBoxW.USER32(00000000,?,?,00002010,00000000,0000FFE9,?,00000040,00000400,00000000,0041194D), ref: 0041192C

Strings

,sP, xrefs: 00411866
TpP, xrefs: 00411858

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: ,sP$TpP
API String ID: 135118572-543533621
Opcode ID: b0f2a119597608f804558f7907db535f44bab8218655489d67a81a254f99b934
Instruction ID: b7781f9c751fc1b34da23ba7100a439b5b90b625aa927673ed66755bdac9fbaf
Opcode Fuzzy Hash: b0f2a119597608f804558f7907db535f44bab8218655489d67a81a254f99b934
Instruction Fuzzy Hash: 9F316FB1650204BEEB10EB65DC42FDA77ACEB05704F50817AB705F61E2DEB86E448B68

Uniqueness

Uniqueness Score: -1.00%

Function 0046B7A0, Relevance: 16.6, APIs: 11, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0046B7A0(void* __eax, void* __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				struct HDC__* _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				char _v56;
				char _v72;
				signed char _t43;
				signed int _t75;
				int _t76;
				int _t77;
				void* _t90;
				intOrPtr _t107;
				void* _t116;
				void* _t119;
				void* _t122;
				void* _t124;
				intOrPtr _t125;

				_t122 = _t124;
				_t125 = _t124 + 0xffffffbc;
				_t90 = __ecx;
				_v8 = __edx;
				_t116 = __eax;
				_t43 = GetWindowLongW(E00463AA8(_v8), 0xffffffec);
				if((_t43 & 0x00000002) == 0) {
					return _t43;
				} else {
					GetWindowRect(E00463AA8(_v8),  &_v44);
					E00409254( &_v44,  ~(_v44.top),  ~(_v44.left));
					_v12 = GetWindowDC(E00463AA8(_v8));
					_push(_t122);
					_push(0x46b8f6);
					_push( *[fs:edx]);
					 *[fs:edx] = _t125;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t119 = _t116;
					if(_t90 != 0) {
						_t75 = GetWindowLongW(E00463AA8(_v8), 0xfffffff0);
						if((_t75 & 0x00100000) != 0 && (_t75 & 0x00200000) != 0) {
							_t76 = GetSystemMetrics(2);
							_t77 = GetSystemMetrics(3);
							InflateRect( &_v28, 0xfffffffe, 0xfffffffe);
							E00409158(_v28.right - _t76, _v28.right, _v28.bottom - _t77,  &_v72, _v28.bottom);
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t119 = _t119;
							FillRect(_v12,  &_v28, GetSysColorBrush(0xf));
						}
					}
					ExcludeClipRect(_v12, _v44.left + 2, _v44.top + 2, _v44.right - 2, _v44.bottom - 2);
					E0046B274( &_v56, 2);
					E0046B134(_t119,  &_v56, _v12,  &_v44);
					_pop(_t107);
					 *[fs:eax] = _t107;
					_push(0x46b8fd);
					return ReleaseDC(E00463AA8(_v8), _v12);
				}
			}

0x0046b7a1
0x0046b7a3
0x0046b7a9
0x0046b7ab
0x0046b7ae
0x0046b7bb
0x0046b7c3
0x0046b903
0x0046b7c9
0x0046b7d6
0x0046b7e8
0x0046b7fb
0x0046b800
0x0046b801
0x0046b806
0x0046b809
0x0046b813
0x0046b814
0x0046b815
0x0046b816
0x0046b817
0x0046b81a
0x0046b827
0x0046b831
0x0046b83c
0x0046b845
0x0046b854
0x0046b86e
0x0046b87a
0x0046b87b
0x0046b87c
0x0046b87d
0x0046b87e
0x0046b88f
0x0046b88f
0x0046b831
0x0046b8b4
0x0046b8c0
0x0046b8d1
0x0046b8d8
0x0046b8db
0x0046b8de
0x0046b8f5
0x0046b8f5

APIs

GetWindowLongW.USER32(00000000,000000EC), ref: 0046B7BB
GetWindowRect.USER32(00000000,?,00000000,000000EC), ref: 0046B7D6
GetWindowDC.USER32(00000000,00000000,?,00000000,000000EC), ref: 0046B7F6
GetWindowLongW.USER32(00000000,000000F0,00000000,0046B8F6,?,00000000,00000000,?,00000000,000000EC), ref: 0046B827
GetSystemMetrics.USER32(00000002,00000000,000000F0,00000000,0046B8F6,?,00000000,00000000,?,00000000,000000EC), ref: 0046B83C
GetSystemMetrics.USER32(00000003,00000002,00000000,000000F0,00000000,0046B8F6,?,00000000,00000000,?,00000000,000000EC), ref: 0046B845
InflateRect.USER32(?,000000FE,000000FE,00000003,00000002,00000000,000000F0,00000000,0046B8F6,?,00000000,00000000,?,00000000,000000EC), ref: 0046B854
GetSysColorBrush.USER32(0000000F,?,?,?,000000FE,000000FE,00000003,00000002,00000000,000000F0,00000000,0046B8F6,?,00000000,00000000,?), ref: 0046B881
FillRect.USER32(?,?,00000000,0000000F,?,?,?,000000FE,000000FE,00000003,00000002,00000000,000000F0,00000000,0046B8F6), ref: 0046B88F
ExcludeClipRect.GDI32(?,?,?,?,?,00000000,0046B8F6,?,00000000,00000000,?,00000000,000000EC), ref: 0046B8B4
ReleaseDC.USER32(00000000,?,0046B8FD,?,?,?,00000000,0046B8F6,?,00000000,00000000,?,00000000,000000EC), ref: 0046B8F0

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: RectWindow$LongMetricsSystem$BrushClipColorExcludeFillInflateRelease
String ID:
API String ID: 3669760922-0
Opcode ID: f768c5b2ba386c056358c8b270d60ea07a62d2cc6284e70491e0f7d96b7cd9ba
Instruction ID: 799ed15ba92f7e1c12a6e19ca3f276d53db28d25a43cbcf8b7e9c9c0eed16d21
Opcode Fuzzy Hash: f768c5b2ba386c056358c8b270d60ea07a62d2cc6284e70491e0f7d96b7cd9ba
Instruction Fuzzy Hash: C5413F72A00109ABCF01EAE9CD42DDFB7BDEF49315F10016AF514F7292D6389E4587A8

Uniqueness

Uniqueness Score: -1.00%

Function 004FE2C8, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 145
fileCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E004FE2C8(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				char _v8;
				struct HWND__* _v12;
				void* _v16;
				char _v20;
				char _v24;
				char _v28;
				struct HWND__* _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				WCHAR* _t41;
				int _t44;
				intOrPtr _t48;
				intOrPtr* _t54;
				void* _t68;
				intOrPtr _t80;
				intOrPtr _t102;
				intOrPtr _t104;
				void* _t108;
				void* _t109;
				intOrPtr _t110;
				void* _t118;

				_t118 = __fp0;
				_t106 = __esi;
				_t105 = __edi;
				_t88 = __ecx;
				_t87 = __ebx;
				_t108 = _t109;
				_t110 = _t109 + 0xffffffd4;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v24 = 0;
				_v48 = 0;
				_v44 = 0;
				_v20 = 0;
				_v8 = 0;
				_push(_t108);
				_push(0x4fe4b6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t110;
				E0047F960( &_v20, __ebx, __ecx, __eflags);
				if(E004AE464(_v20, __ebx,  &_v8, __edi, __esi) == 0) {
					_push(_t108);
					_push( *[fs:eax]);
					 *[fs:eax] = _t110;
					E004AE954(0, _t87, _v8, __edi, __esi);
					_pop(_t104);
					_t88 = 0x4fe32b;
					 *[fs:eax] = _t104;
				}
				_t41 = E004064D4(_v8);
				_t44 = CopyFileW(E004064D4( *0x50d168), _t41, 0);
				_t113 = _t44;
				if(_t44 == 0) {
					_t80 =  *0x505e6c; // 0x50c83c
					_t11 = _t80 + 0x1a4; // 0x0
					E004FD7D8( *_t11, _t87, _t88, _t106, _t113);
				}
				SetFileAttributesW(E004064D4(_v8), 0x80);
				_t48 =  *0x509b50; // 0x400000
				_v12 = E0040A124(0, L"STATIC", 0, _t48, 0, 0, 0, 0, 0, 0, 0);
				 *0x50d194 = SetWindowLongW(_v12, 0xfffffffc, E004FD998);
				_push(_t108);
				_push(0x4fe47f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t110;
				_t54 =  *0x505e5c; // 0x50c17c
				SetWindowPos( *( *_t54 + 0x170), 0, 0, 0, 0, 0, 0x97);
				E0047F334(0, _t87,  &_v44, _t105, _t106);
				_v40 = _v44;
				_v36 = 0x11;
				_v32 = _v12;
				_v28 = 0;
				E0040E2C8(L"/SECONDPHASE=\"%s\" /FIRSTPHASEWND=$%x ", 1,  &_v40,  &_v24);
				_push( &_v24);
				E0047F214( &_v48, _t87, _t106, 0);
				_pop(_t68);
				E00406854(_t68, _v48);
				_v16 = E004FD880(_v8, _t87, _v24, _t105, _t106, _t118);
				do {
				} while (E004FD95C() == 0 && MsgWaitForMultipleObjects(1,  &_v16, 0, 0xffffffff, 0xff) == 1);
				CloseHandle(_v16);
				_pop(_t102);
				 *[fs:eax] = _t102;
				_push(E004FE486);
				return DestroyWindow(_v12);
			}

0x004fe2c8
0x004fe2c8
0x004fe2c8
0x004fe2c8
0x004fe2c8
0x004fe2c9
0x004fe2cb
0x004fe2ce
0x004fe2cf
0x004fe2d0
0x004fe2d3
0x004fe2d6
0x004fe2d9
0x004fe2dc
0x004fe2df
0x004fe2e4
0x004fe2e5
0x004fe2ea
0x004fe2ed
0x004fe2f3
0x004fe305
0x004fe309
0x004fe30f
0x004fe312
0x004fe31c
0x004fe323
0x004fe325
0x004fe326
0x004fe326
0x004fe33a
0x004fe34b
0x004fe350
0x004fe352
0x004fe354
0x004fe359
0x004fe35f
0x004fe35f
0x004fe372
0x004fe385
0x004fe39e
0x004fe3b1
0x004fe3b8
0x004fe3b9
0x004fe3be
0x004fe3c1
0x004fe3d3
0x004fe3e1
0x004fe3ef
0x004fe3f7
0x004fe3fa
0x004fe401
0x004fe404
0x004fe415
0x004fe41d
0x004fe421
0x004fe429
0x004fe42a
0x004fe43a
0x004fe43d
0x004fe442
0x004fe463
0x004fe46a
0x004fe46d
0x004fe470
0x004fe47e

APIs

Part of subcall function 004AE464: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,004AE59F), ref: 004AE54F
Part of subcall function 004AE464: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,004AE59F), ref: 004AE55F

CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,004FE4B6), ref: 004FE34B
SetFileAttributesW.KERNEL32(00000000,00000080,00000000,00000000,00000000,00000000,004FE4B6), ref: 004FE372
SetWindowLongW.USER32(?,000000FC,004FD998,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000080,00000000,00000000), ref: 004FE3AC
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004FE47F,?,?,000000FC,004FD998,00000000,00400000,00000000), ref: 004FE3E1
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004FE47F), ref: 004FE455
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004FE47F,?,?,000000FC,004FD998,00000000), ref: 004FE463

Part of subcall function 004AE954: WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,004AEB86,?,00000000,004AEBE8,?,?,00000000,004AEC82,?,?,00000000), ref: 004AEA3A

DestroyWindow.USER32(?,004FE486,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004FE47F,?,?,000000FC,004FD998,00000000,00400000), ref: 004FE479

Strings

/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 004FE410
STATIC, xrefs: 004FE392

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWindow$CloseHandle$AttributesCopyCreateDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1779715363-2312673372
Opcode ID: bf05956ccd99067bbb7fbef34b862bc2cc7e9b6b83abceea8143b6896bf860d4
Instruction ID: 3487dc1684872b65f20f953cd537f2af4b6d24faff24540146e6f7be6bcbdc4b
Opcode Fuzzy Hash: bf05956ccd99067bbb7fbef34b862bc2cc7e9b6b83abceea8143b6896bf860d4
Instruction Fuzzy Hash: 9C415170A04208AFDB00EFB6CC52AAE77F8EB09314F11457AF604F7292D6799904CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004B4254, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 124
pipeCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E004B4254(intOrPtr __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __fp0, char _a4) {
				intOrPtr _v8;
				long _v12;
				void* _v16;
				struct _OVERLAPPED _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				long _t83;
				intOrPtr _t94;
				void* _t99;
				void* _t100;
				intOrPtr _t101;

				_t99 = _t100;
				_t101 = _t100 + 0xffffffd8;
				_v40 = 0;
				_v44 = 0;
				_v8 = __eax;
				_push(_t99);
				_push(0x4b4492);
				_push( *[fs:eax]);
				 *[fs:eax] = _t101;
				 *(_v8 + 0x14) =  *(_v8 + 0x14) + 1;
				 *(_v8 + 0x20) =  *(_v8 + 0x14);
				 *((intOrPtr*)(_v8 + 0x24)) = __edx;
				 *((intOrPtr*)(_v8 + 0x28)) = __ecx;
				_t83 = 0xc + __ecx;
				_push(_t99);
				_push(0x4b4437);
				_push( *[fs:edx]);
				 *[fs:edx] = _t101;
				_v16 = CreateEventW(0, 0xffffffff, 0, 0);
				if(_v16 == 0) {
					E004ADFA0(L"CreateEvent");
				}
				_push(_t99);
				_push(0x4b43cc);
				_push( *[fs:edx]);
				 *[fs:edx] = _t101;
				E00403540( &_v36, 0x14);
				_v36.hEvent = _v16;
				if(TransactNamedPipe( *(_v8 + 0xc), _v8 + 0x20, _t83, _v8 + 0x4034, 0x14,  &_v12,  &_v36) != 0) {
					_pop(_t94);
					 *[fs:eax] = _t94;
					_push(E004B43D3);
					return CloseHandle(_v16);
				} else {
					if(GetLastError() != 0x3e5) {
						E004ADFA0(L"TransactNamedPipe");
					}
					_push(_t99);
					_push(0x4b439e);
					_push( *[fs:edx]);
					 *[fs:edx] = _t101;
					if(_a4 != 0 &&  *((short*)(_v8 + 0x1a)) != 0) {
						do {
							 *((intOrPtr*)(_v8 + 0x18))();
						} while (MsgWaitForMultipleObjects(1,  &_v16, 0, 0xffffffff, 0xff) == 1);
					}
					_pop( *[fs:0x0]);
					_push(E004B43A5);
					GetOverlappedResult( *(_v8 + 0xc),  &_v36,  &_v12, 0xffffffff);
					return GetLastError();
				}
			}

0x004b4255
0x004b4257
0x004b425f
0x004b4262
0x004b4265
0x004b426a
0x004b426b
0x004b4270
0x004b4273
0x004b4279
0x004b4285
0x004b428b
0x004b4291
0x004b4299
0x004b429d
0x004b429e
0x004b42a3
0x004b42a6
0x004b42b6
0x004b42bd
0x004b42c4
0x004b42c4
0x004b42cb
0x004b42cc
0x004b42d1
0x004b42d4
0x004b42e1
0x004b42e9
0x004b4315
0x004b43b7
0x004b43ba
0x004b43bd
0x004b43cb
0x004b431b
0x004b4325
0x004b432c
0x004b432c
0x004b4333
0x004b4334
0x004b4339
0x004b433c
0x004b4343
0x004b434f
0x004b4355
0x004b436c
0x004b434f
0x004b4371
0x004b437b
0x004b4391
0x004b439d
0x004b439d

APIs

CreateEventW.KERNEL32(00000000,000000FF,00000000,00000000,00000000,004B4437,?,00000000,004B4492,?,?,00000000,00000000), ref: 004B42B1
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,004B43CC,?,00000000,000000FF,00000000,00000000,00000000,004B4437), ref: 004B430E
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,004B43CC,?,00000000,000000FF,00000000,00000000,00000000,004B4437), ref: 004B431B
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF,?,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,004B43CC), ref: 004B4367
GetOverlappedResult.KERNEL32(?,?,00000000,000000FF,004B43A5,00000000,00000000), ref: 004B4391
GetLastError.KERNEL32(?,?,00000000,000000FF,004B43A5,00000000,00000000), ref: 004B4398

Part of subcall function 004ADFA0: GetLastError.KERNEL32(00000000,004AEC5A,00000005,00000000,004AEC82,?,?,00000000,0050C17C,00000000,00000000,00000000,?,004FFFA7,00000000,004FFFC2), ref: 004ADFA3

Strings

CreateEvent, xrefs: 004B42BF
TransactNamedPipe, xrefs: 004B4327

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: a9b4bf537db35c0d247b1b131712c855710014e410ba64d8be44f9394c1318cc
Instruction ID: 8baea4b2f0aadaa95f052aa5f722c07845289a41dec6a8cb500231b01d111480
Opcode Fuzzy Hash: a9b4bf537db35c0d247b1b131712c855710014e410ba64d8be44f9394c1318cc
Instruction Fuzzy Hash: AD418D71A00208AFDB11DF99CD81FDEB7F8EB49714F5441A6F900E7792D6389E10CA28

Uniqueness

Uniqueness Score: -1.00%

Function 0042E08C, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0042E08C(struct HDC__* _a4, RECT* _a8, intOrPtr _a12, intOrPtr _a16) {
				struct tagPOINT _v12;
				int _v16;
				struct tagRECT _v32;
				struct tagRECT _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t60;
				int _t61;
				intOrPtr _t63;
				RECT* _t64;
				struct HDC__* _t65;

				_t64 = _a8;
				_t65 = _a4;
				if( *0x50bedf != 0) {
					_t61 = 0;
					if(_a12 == 0) {
						L14:
						return _t61;
					}
					_v32.left = 0;
					_v32.top = 0;
					_v32.right = GetSystemMetrics(0);
					_v32.bottom = GetSystemMetrics(1);
					if(_t65 == 0) {
						if(_t64 == 0 || IntersectRect( &_v32,  &_v32, _t64) != 0) {
							L13:
							_t61 = _a12(0x12340042, _t65,  &_v32, _a16);
						} else {
							_t61 = 1;
						}
						goto L14;
					}
					_v16 = GetClipBox(_t65,  &_v48);
					if(GetDCOrgEx(_t65,  &_v12) == 0) {
						goto L14;
					}
					OffsetRect( &_v32,  ~(_v12.x),  ~(_v12.y));
					if(IntersectRect( &_v32,  &_v32,  &_v48) == 0 || _t64 != 0) {
						if(IntersectRect( &_v32,  &_v32, _t64) != 0) {
							goto L13;
						}
						if(_v16 == 1) {
							_t61 = 1;
						}
						goto L14;
					} else {
						goto L13;
					}
				}
				_t63 =  *0x50becc; // 0x7743c640
				 *0x50becc = E0042DA04(7, _t60, L"EnumDisplayMonitors", _t63, _t64, _t65);
				_t61 =  *0x50becc(_t65, _t64, _a12, _a16);
				goto L14;
			}

0x0042e095
0x0042e098
0x0042e0a2
0x0042e0d2
0x0042e0d8
0x0042e194
0x0042e19c
0x0042e19c
0x0042e0e0
0x0042e0e5
0x0042e0f0
0x0042e0fb
0x0042e100
0x0042e169
0x0042e181
0x0042e192
0x0042e17d
0x0042e17d
0x0042e17d
0x00000000
0x0042e169
0x0042e10c
0x0042e11b
0x00000000
0x00000000
0x0042e12d
0x0042e145
0x0042e15b
0x00000000
0x00000000
0x0042e161
0x0042e163
0x0042e163
0x00000000
0x00000000
0x00000000
0x00000000
0x0042e145
0x0042e0a9
0x0042e0b6
0x0042e0cb
0x00000000

APIs

GetSystemMetrics.USER32(00000000), ref: 0042E0EA
GetSystemMetrics.USER32(00000001), ref: 0042E0F5
GetClipBox.GDI32(?,?), ref: 0042E107
GetDCOrgEx.GDI32(?,?,?,?), ref: 0042E114
OffsetRect.USER32(?,?,?,?,?,?,?), ref: 0042E12D
IntersectRect.USER32(?,?,?,?,?,?,?,?,?,?), ref: 0042E13E
IntersectRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0042E154

Part of subcall function 0042DA04: GetProcAddress.KERNEL32(77400000,00000000,00000000,0042DAE6), ref: 0042DAA0

Strings

EnumDisplayMonitors, xrefs: 0042E0A4

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$IntersectMetricsSystem$AddressClipOffsetProc
String ID: EnumDisplayMonitors
API String ID: 472983485-2491903729
Opcode ID: f9a36c5d91ffe04e39252c769717a1b62a62feab28102cf1360176a14c1e27dd
Instruction ID: 1cf2fc767d957ebea68298b76d85816a55913de9ebca9a8d29ec02f473f35c6a
Opcode Fuzzy Hash: f9a36c5d91ffe04e39252c769717a1b62a62feab28102cf1360176a14c1e27dd
Instruction Fuzzy Hash: EA31EC72A00219AADB10DEA6DC85AFFB7BCAF05300F504137EA15E3241E77899158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00431A58, Relevance: 15.2, APIs: 10, Instructions: 224
windowCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00431A58(intOrPtr* __eax, intOrPtr* __ecx, int* __edx, void* __fp0, intOrPtr _a4, int* _a8) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				int _v16;
				int _v20;
				int _v24;
				long _v28;
				long _v32;
				struct HDC__* _v36;
				intOrPtr* _v40;
				void* _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				int* _t197;
				intOrPtr _t211;
				void* _t214;
				int _t217;
				int* _t219;
				void* _t222;
				void* _t224;
				intOrPtr _t225;

				_t199 = __ecx;
				_t222 = _t224;
				_t225 = _t224 + 0xffffffd8;
				_push(_t214);
				_v12 = __ecx;
				_t219 = __edx;
				_v8 = __eax;
				_t197 = _a8;
				if(_v12 != 0) {
					E00432024(_v8);
					 *[fs:eax] = _t225;
					 *((intOrPtr*)( *_v8 + 0x10))( *[fs:eax], 0x431d01, _t222);
					E004326C8(_v8, __ecx,  *0x431d14 & 0x000000ff, _t214);
					E00432024(E004356CC(_v12));
					_push(_t222);
					_push(0x431cdc);
					_push( *[fs:eax]);
					 *[fs:eax] = _t225;
					_v20 = _t219[2] -  *_t219;
					_v24 = _t219[3] - _t219[1];
					_t217 = _t197[2] -  *_t197;
					_v16 = _t197[3] - _t197[1];
					if(E00435A24(_v12, _t199) != _a4) {
						_v40 = E00434DB4(1);
						_t199 =  *_v40;
						 *((intOrPtr*)( *_v40 + 8))();
						E00435B98(_v40, _a4, __eflags, __fp0);
						E004326C8(E004356CC(_v40),  *_v40,  *0x431d18 & 0x000000ff, _t217);
						_v36 =  *((intOrPtr*)(E004356CC(_v40) + 4));
						__eflags = 0;
						_v44 = 0;
					} else {
						_v40 = 0;
						_v44 =  *((intOrPtr*)( *_v12 + 0x74))();
						_v36 = CreateCompatibleDC(0);
						_v44 = SelectObject(_v36, _v44);
					}
					_push(_t222);
					_push(0x431cba);
					_push( *[fs:eax]);
					 *[fs:eax] = _t225;
					E004326C8(E004356CC(_v12), _t199,  *0x431d18 & 0x000000ff, _t217);
					if(E00431884( *((intOrPtr*)(_v8 + 0x14))) != 1) {
						StretchBlt( *(_v8 + 4),  *_t219, _t219[1], _v20, _v24,  *(E004356CC(_v12) + 4),  *_t197, _t197[1], _t217, _v16, 0xcc0020);
						_v32 = SetTextColor( *(_v8 + 4), 0);
						_v28 = SetBkColor( *(_v8 + 4), 0xffffff);
						StretchBlt( *(_v8 + 4),  *_t219, _t219[1], _v20, _v24, _v36,  *_t197, _t197[1], _t217, _v16, 0xe20746);
						SetTextColor( *(_v8 + 4), _v32);
						SetBkColor( *(_v8 + 4), _v28);
					} else {
						E00432B94( *(_v8 + 4), _t197, _t219[1],  *_t219, _t217, _t219, _t197[1],  *_t197, _v36, _v16, _t217, _t197[1],  *_t197,  *(E004356CC(_v12) + 4), _v24, _v20);
					}
					_pop(_t211);
					 *[fs:eax] = _t211;
					_push(0x431cc1);
					if(_v40 == 0) {
						__eflags = _v44;
						if(_v44 != 0) {
							SelectObject(_v36, _v44);
						}
						return DeleteDC(_v36);
					} else {
						return E00404098(_v40);
					}
				}
				return __eax;
			}

0x00431a58
0x00431a59
0x00431a5b
0x00431a60
0x00431a61
0x00431a64
0x00431a66
0x00431a69
0x00431a70
0x00431a79
0x00431a89
0x00431a91
0x00431a9e
0x00431aab
0x00431ab2
0x00431ab3
0x00431ab8
0x00431abb
0x00431ac3
0x00431acc
0x00431ad2
0x00431ada
0x00431ae8
0x00431b22
0x00431b2b
0x00431b2d
0x00431b36
0x00431b4a
0x00431b5a
0x00431b5d
0x00431b5f
0x00431aea
0x00431aec
0x00431af7
0x00431b01
0x00431b11
0x00431b11
0x00431b64
0x00431b65
0x00431b6a
0x00431b6d
0x00431b7f
0x00431b91
0x00431c06
0x00431c19
0x00431c2d
0x00431c5b
0x00431c6b
0x00431c7b
0x00431b93
0x00431bc9
0x00431bc9
0x00431c82
0x00431c85
0x00431c88
0x00431c91
0x00431c9d
0x00431ca1
0x00431cab
0x00431cab
0x00000000
0x00431c93
0x00000000
0x00431c96
0x00431c91
0x00431d0e

APIs

Part of subcall function 00432024: EnterCriticalSection.KERNEL32(0050BF20,00000000,0043416D,00000000,?,?,00435AF6,00436584,00000000,?,?), ref: 0043202C
Part of subcall function 00432024: LeaveCriticalSection.KERNEL32(0050BF20,0050BF20,00000000,0043416D,00000000,?,?,00435AF6,00436584,00000000,?,?), ref: 00432039
Part of subcall function 00432024: EnterCriticalSection.KERNEL32(?,0050BF20,0050BF20,00000000,0043416D,00000000,?,?,00435AF6,00436584,00000000,?,?), ref: 00432042

CreateCompatibleDC.GDI32(00000000), ref: 00431AFC
SelectObject.GDI32(?,?,00000000), ref: 00431B0C
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00CC0020,00000000,00431CBA), ref: 00431C06
SetTextColor.GDI32(?,00000000,?,?,?,?,?,?,?,?,00000000,?,00CC0020,00000000,00431CBA), ref: 00431C14
SetBkColor.GDI32(?,00FFFFFF,?,00000000,?,?,?,?,?,?,?,?,00000000,?,00CC0020,00000000), ref: 00431C28
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00E20746,?,00FFFFFF,?,00000000,?), ref: 00431C5B
SetTextColor.GDI32(?,?,?,?,?,?,?,?,?,?,00000000,?,00E20746,?,00FFFFFF,?), ref: 00431C6B
SetBkColor.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00E20746,?), ref: 00431C7B
SelectObject.GDI32(?,00000000,00431CC1,?,?,?,?,?,?,?,?,?,00000000,?,00E20746,?), ref: 00431CAB
DeleteDC.GDI32(?,00431CC1,?,?,?,?,?,?,?,?,?,00000000,?,00E20746,?,00FFFFFF), ref: 00431CB4

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$CriticalSection$EnterObjectSelectStretchText$CompatibleCreateDeleteLeave
String ID:
API String ID: 675119849-0
Opcode ID: 9be7bf94e7d034e574ca3e1261276cf64dbc7d478221a65f1c08866e88d5c9c7
Instruction ID: 050884de6b3f1275efe6bb71258341b8235dda9f70388dff915321152a00aa7a
Opcode Fuzzy Hash: 9be7bf94e7d034e574ca3e1261276cf64dbc7d478221a65f1c08866e88d5c9c7
Instruction Fuzzy Hash: DF919775A00108AFCB50DFA9C985E9EBBF8AF0D304F1454AAF518E7361C634ED40CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0046147C, Relevance: 15.2, APIs: 10, Instructions: 197
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0046147C(intOrPtr __eax, void* __ebx, void* __ecx, struct HDC__* __edx, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				struct HDC__* _v12;
				int _v16;
				struct tagRECT _v32;
				signed int _t102;
				intOrPtr _t108;
				intOrPtr _t115;
				int _t131;
				intOrPtr _t143;
				int _t165;
				void* _t167;
				void* _t168;
				intOrPtr _t183;
				signed int _t190;
				signed int _t192;
				int _t196;
				void* _t197;
				void* _t200;

				_v12 = __edx;
				_v8 = __eax;
				 *(_v8 + 0x54) =  *(_v8 + 0x54) | 0x00000080;
				_v16 = SaveDC(_v12);
				_push(_t200);
				_push(0x4616b5);
				_push( *[fs:edx]);
				 *[fs:edx] = _t200 + 0xffffffe4;
				E00459688(_v12, _a4, __ecx);
				IntersectClipRect(_v12, 0, 0,  *(_v8 + 0x48),  *(_v8 + 0x4c));
				_t196 = 0;
				_t165 = 0;
				if((GetWindowLongW(E00463AA8(_v8), 0xffffffec) & 0x00000002) == 0) {
					_t102 = GetWindowLongW(E00463AA8(_v8), 0xfffffff0);
					__eflags = _t102 & 0x00800000;
					if((_t102 & 0x00800000) != 0) {
						_t165 = 3;
						_t196 = 0xa00f;
					}
				} else {
					_t165 = 0xa;
					_t196 = 0x200f;
				}
				if(_t165 != 0xa || E0046B078(E0046AF6C()) == 0 || ( *(_v8 + 0x1c) & 0x00000010) != 0 && E0046AF00(_v8) != 0) {
					__eflags = _t196;
					if(_t196 != 0) {
						SetRect( &_v32, 0, 0,  *(_v8 + 0x48),  *(_v8 + 0x4c));
						DrawEdge(_v12,  &_v32, _t165, _t196);
						E00459688(_v12, _v32.top, _v32.left);
						_t131 = _v32.right - _v32.left;
						__eflags = _t131;
						IntersectClipRect(_v12, 0, 0, _t131, _v32.bottom - _v32.top);
					}
				} else {
					SetRect( &_v32, 0, 0,  *(_v8 + 0x48),  *(_v8 + 0x4c));
					_t143 = _v8;
					_t208 =  *(_t143 + 0x52) & 0x00000002;
					if(( *(_t143 + 0x52) & 0x00000002) == 0) {
						 *(_v8 + 0x50) =  *(_v8 + 0x50) |  *0x4616d0;
						E004613D0(_v12,  &_v32, __eflags);
						_t190 =  *0x4616d0; // 0x20000
						_t192 =  !_t190 &  *(_v8 + 0x50);
						__eflags = _t192;
						 *(_v8 + 0x50) = _t192;
					} else {
						E004613D0(_v12,  &_v32, _t208);
					}
					E00459688(_v12, _v32.top, _v32.left);
					IntersectClipRect(_v12, 0, 0, _v32.right - _v32.left, _v32.bottom - _v32.top);
				}
				E0045C4F0(_v8, _v12, 0x14, 0);
				E0045C4F0(_v8, _v12, 0xf, 0);
				_t108 =  *((intOrPtr*)(_v8 + 0x1d8));
				if(_t108 == 0) {
					L20:
					_pop(_t183);
					 *[fs:eax] = _t183;
					_push(0x4616bc);
					return RestoreDC(_v12, _v16);
				} else {
					_t167 =  *((intOrPtr*)(_t108 + 8)) - 1;
					if(_t167 < 0) {
						goto L20;
					}
					_t168 = _t167 + 1;
					_t197 = 0;
					do {
						_t115 = E00423584( *((intOrPtr*)(_v8 + 0x1d8)), _t197);
						_t212 =  *((char*)(_t115 + 0x57));
						if( *((char*)(_t115 + 0x57)) != 0) {
							E0046147C(_t115, _t168,  *((intOrPtr*)(_t115 + 0x40)), _v12, _t197, _t212,  *((intOrPtr*)(_t115 + 0x44)));
						}
						_t197 = _t197 + 1;
						_t168 = _t168 - 1;
					} while (_t168 != 0);
					goto L20;
				}
			}

0x00461486
0x00461489
0x0046148f
0x0046149e
0x004614a3
0x004614a4
0x004614a9
0x004614ac
0x004614b7
0x004614d2
0x004614d7
0x004614d9
0x004614ee
0x00461507
0x0046150c
0x00461511
0x00461513
0x00461518
0x00461518
0x004614f0
0x004614f0
0x004614f5
0x004614f5
0x00461520
0x004615de
0x004615e0
0x004615f8
0x00461607
0x00461615
0x00461624
0x00461624
0x00461630
0x00461630
0x00461551
0x00461567
0x0046156c
0x0046156f
0x00461573
0x00461591
0x0046159a
0x004615a2
0x004615aa
0x004615aa
0x004615b0
0x00461575
0x0046157b
0x0046157b
0x004615bc
0x004615d7
0x004615d7
0x00461642
0x00461654
0x0046165c
0x00461664
0x0046169a
0x0046169c
0x0046169f
0x004616a2
0x004616b4
0x00461666
0x00461669
0x0046166c
0x00000000
0x00000000
0x0046166e
0x0046166f
0x00461671
0x0046167c
0x00461681
0x00461685
0x00461691
0x00461691
0x00461696
0x00461697
0x00461697
0x00000000
0x00461671

APIs

SaveDC.GDI32(?), ref: 00461499

Part of subcall function 00459688: GetWindowOrgEx.GDI32(?), ref: 00459696
Part of subcall function 00459688: SetWindowOrgEx.GDI32(?,?,?,00000000,?), ref: 004596AC

IntersectClipRect.GDI32(?,00000000,00000000,?,?,00000000,004616B5,?,?), ref: 004614D2
GetWindowLongW.USER32(00000000,000000EC,?,00000000,00000000,?,?,00000000,004616B5,?,?), ref: 004614E6
GetWindowLongW.USER32(00000000,000000F0,00000000,000000EC,?,00000000,00000000,?,?,00000000,004616B5,?,?), ref: 00461507
SetRect.USER32(00000010,00000000,00000000,?,?,00000000,000000F0,00000000,000000EC,?,00000000,00000000,?,?,00000000,004616B5), ref: 00461567
IntersectClipRect.GDI32(?,00000000,00000000,00000010,?,00000010,00000000,00000000,?,?,00000000,000000F0,00000000,000000EC,?,00000000), ref: 004615D7

Part of subcall function 004613D0: SaveDC.GDI32(?), ref: 004613E0
Part of subcall function 004613D0: ExcludeClipRect.GDI32(?,?,?,?,?,00000000,00461464,?,?), ref: 00461421
Part of subcall function 004613D0: RestoreDC.GDI32(?,?,0046146B,?,?,?,00000000,00461464,?,?), ref: 0046145E

SetRect.USER32(?,00000000,00000000,?,?,00000000,000000F0,00000000,000000EC,?,00000000,00000000,?,?,00000000,004616B5), ref: 004615F8
DrawEdge.USER32(?,?,00000000,00000000,?,00000000,00000000,?,?,00000000,000000F0,00000000,000000EC,?,00000000,00000000), ref: 00461607
IntersectClipRect.GDI32(?,00000000,00000000,?,?,?,?,00000000,00000000,?,00000000,00000000,?,?,00000000,000000F0), ref: 00461630
RestoreDC.GDI32(?,?,004616BC,000000F0,00000000,000000EC,?,00000000,00000000,?,?,00000000,004616B5,?,?), ref: 004616AF

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$ClipWindow$Intersect$LongRestoreSave$DrawEdgeExclude
String ID:
API String ID: 3997055466-0
Opcode ID: c552599c10b2fe6feb44d74a62191f640d42093aa8a33668bf53e0cc7bef9998
Instruction ID: 9a0b655361e46ee8728ed40e32112afa29c8dc77f94030fe453846ae517a018e
Opcode Fuzzy Hash: c552599c10b2fe6feb44d74a62191f640d42093aa8a33668bf53e0cc7bef9998
Instruction Fuzzy Hash: C7710C75E00209AFDB10DF99C985FAEB7B8AF48304F144196B901E73A2D778AE41CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0047813C, Relevance: 15.2, APIs: 10, Instructions: 163
windowCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E0047813C(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v22;
				intOrPtr _v28;
				struct HWND__* _v32;
				char _v36;
				intOrPtr _t58;
				intOrPtr _t64;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr _t77;
				intOrPtr _t79;
				intOrPtr _t89;
				intOrPtr _t91;
				intOrPtr _t94;
				void* _t99;
				intOrPtr _t108;
				intOrPtr _t139;
				void* _t141;
				void* _t144;
				void* _t145;
				intOrPtr _t146;

				_t142 = __esi;
				_t141 = __edi;
				_t122 = __ebx;
				_t144 = _t145;
				_t146 = _t145 + 0xffffffe0;
				_push(__ebx);
				_push(__esi);
				_v36 = 0;
				_v8 = __eax;
				_push(_t144);
				_push(0x478466);
				_push( *[fs:eax]);
				 *[fs:eax] = _t146;
				E004595A8();
				if( *((char*)(_v8 + 0x57)) != 0 ||  *((intOrPtr*)( *_v8 + 0x4c))() == 0 || ( *(_v8 + 0x374) & 0x00000008) != 0 ||  *((char*)(_v8 + 0x287)) == 1) {
					_t58 =  *0x505cf4; // 0x42e48c
					E00408D5C(_t58,  &_v36);
					E004119A0(_v36, 1);
					E00404A74();
				}
				if(GetCapture() != 0) {
					SendMessageW(GetCapture(), 0x1f, 0, 0);
				}
				ReleaseCapture();
				_t64 =  *0x50c17c; // 0x0
				E0047B004(_t64);
				_push(_t144);
				_push(0x478449);
				_push( *[fs:edx]);
				 *[fs:edx] = _t146;
				_v32 = GetActiveWindow();
				 *(_v8 + 0x374) =  *(_v8 + 0x374) | 0x00000008;
				if( *((char*)(_v8 + 0x338)) == 0) {
					_t108 =  *0x50c17c; // 0x0
					if( *((char*)(_t108 + 0xcc)) != 0) {
						E00460104(_v8);
						E00463A84(_v8);
						if(_v32 == 0 || IsWindow(_v32) == 0) {
							_v32 = GetActiveWindow();
						}
					}
				}
				_v20 = E00470AE8();
				_t70 =  *0x50c180; // 0x0
				_t71 =  *0x50c180; // 0x0
				E00423604( *((intOrPtr*)(_t71 + 0x74)),  *((intOrPtr*)(_t70 + 0x70)), 0);
				_t74 =  *0x50c180; // 0x0
				 *((intOrPtr*)(_t74 + 0x70)) = _v8;
				_t75 =  *0x50c180; // 0x0
				_v22 =  *(_t75 + 0x44) & 0x0000ffff;
				_t77 =  *0x50c180; // 0x0
				E00479D40(_t77, 0);
				_t79 =  *0x50c180; // 0x0
				_v28 =  *((intOrPtr*)(_t79 + 0x48));
				_v16 = E00470C94(0, _t122, _t141, _t142);
				_push(_t144);
				_push(0x478427);
				_push( *[fs:edx]);
				 *[fs:edx] = _t146;
				E0047804C(_v8);
				_push(_t144);
				_push(0x478369);
				_push( *[fs:edx]);
				 *[fs:edx] = _t146;
				SendMessageW(E00463AA8(_v8), 0xb000, 0, 0);
				 *((intOrPtr*)(_v8 + 0x2a4)) = 0;
				do {
					_t89 =  *0x50c17c; // 0x0
					E0047C458(_t89, _t141, _t142);
					_t91 =  *0x50c17c; // 0x0
					if( *((char*)(_t91 + 0xa0)) == 0) {
						if( *((intOrPtr*)(_v8 + 0x2a4)) != 0) {
							E00477FAC(_v8);
						}
					} else {
						 *((intOrPtr*)(_v8 + 0x2a4)) = 2;
					}
					_t94 =  *((intOrPtr*)(_v8 + 0x2a4));
				} while (_t94 == 0);
				_v12 = _t94;
				SendMessageW(E00463AA8(_v8), 0xb001, 0, 0);
				_t99 = E00463AA8(_v8);
				if(_t99 != GetActiveWindow()) {
					_v32 = 0;
				}
				_pop(_t139);
				 *[fs:eax] = _t139;
				_push(0x478370);
				return E00478044();
			}

0x0047813c
0x0047813c
0x0047813c
0x0047813d
0x0047813f
0x00478142
0x00478143
0x00478146
0x00478149
0x0047814e
0x0047814f
0x00478154
0x00478157
0x0047815a
0x00478166
0x0047818f
0x00478194
0x004781a3
0x004781a8
0x004781a8
0x004781b4
0x004781c2
0x004781c2
0x004781c7
0x004781cc
0x004781d1
0x004781d8
0x004781d9
0x004781de
0x004781e1
0x004781e9
0x004781ef
0x00478200
0x00478202
0x0047820e
0x00478213
0x0047821b
0x00478224
0x00478238
0x00478238
0x00478224
0x0047820e
0x00478240
0x00478243
0x0047824b
0x00478255
0x0047825a
0x00478262
0x00478265
0x0047826e
0x00478274
0x00478279
0x0047827e
0x00478286
0x00478290
0x00478295
0x00478296
0x0047829b
0x0047829e
0x004782a4
0x004782ab
0x004782ac
0x004782b1
0x004782b4
0x004782c9
0x004782d3
0x004782d9
0x004782d9
0x004782de
0x004782e3
0x004782ef
0x0047830a
0x0047830f
0x0047830f
0x004782f1
0x004782f4
0x004782f4
0x00478317
0x0047831d
0x00478321
0x00478336
0x0047833e
0x0047834c
0x00478350
0x00478350
0x00478355
0x00478358
0x0047835b
0x00478368

APIs

GetCapture.USER32(00000000,00478466), ref: 004781AD
GetCapture.USER32(0000001F,00000000,00000000,00000000,00478466), ref: 004781BC
SendMessageW.USER32(00000000,0000001F,00000000,00000000,00000000,00478466), ref: 004781C2
ReleaseCapture.USER32(00000000,00478466), ref: 004781C7
GetActiveWindow.USER32(00000000,00478449,?,00000000,00478466), ref: 004781E4
IsWindow.USER32(00000000), ref: 0047822A
GetActiveWindow.USER32(00000000), ref: 00478233
SendMessageW.USER32(00000000,0000B000,00000000,00000000,00000000,00478369,?,00000000,00478427), ref: 004782C9
SendMessageW.USER32(00000000,0000B001,00000000,00000000,00000000,0000B000,00000000,00000000,00000000,00478369,?,00000000,00478427), ref: 00478336
GetActiveWindow.USER32(00000000,0000B001,00000000,00000000,00000000,0000B000,00000000,00000000,00000000,00478369,?,00000000,00478427), ref: 00478345

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$ActiveCaptureMessageSend$Release
String ID:
API String ID: 3054343883-0
Opcode ID: 9e96cec202d4202f19decc5567e39e1dd2a58edbc18b1c9d67eb02c5ef3e39c9
Instruction ID: 2f60867dbd0ae5023695ed7153107edbe3f3b4c1c51422ea3575df041edfcceb
Opcode Fuzzy Hash: 9e96cec202d4202f19decc5567e39e1dd2a58edbc18b1c9d67eb02c5ef3e39c9
Instruction Fuzzy Hash: B4615270A40644AFDB10EF69C946B9E7BF5FF45704F5480AAF408AB3A2DB789D04DB48

Uniqueness

Uniqueness Score: -1.00%

Function 004382E8, Relevance: 15.1, APIs: 10, Instructions: 89
synchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E004382E8(void* __eax, long __ecx, struct _CRITICAL_SECTION* __edx) {
				long _v8;
				signed int _v9;
				void* _v16;
				intOrPtr _v20;
				char _v24;
				void* __ebx;
				void* __ebp;
				void* _t39;
				struct _CRITICAL_SECTION* _t51;
				intOrPtr _t59;
				void* _t61;
				intOrPtr _t65;
				void* _t67;
				void* _t69;
				intOrPtr _t70;

				_t53 = __ecx;
				_t67 = _t69;
				_t70 = _t69 + 0xffffffec;
				_v8 = __ecx;
				_t51 = __edx;
				_t61 = __eax;
				if(GetCurrentThreadId() !=  *((intOrPtr*)(_t51 + 0xc))) {
					_v9 = 0;
					return _v9 & 0x000000ff;
				} else {
					_v24 = 0;
					_v20 =  *((intOrPtr*)(_t51 + 0xc));
					_v16 = CreateEventW(0, 0, 0, 0);
					_push(_t67);
					_push(0x4383c9);
					_push( *[fs:eax]);
					 *[fs:eax] = _t70;
					_t65 =  *((intOrPtr*)(_t51 + 8));
					E004381F4(_t61, _t51, _t53,  &_v24);
					 *((intOrPtr*)(_t51 + 8)) = 1;
					InterlockedExchangeAdd(_t51 + 4,  ~(_t65 - 1));
					LeaveCriticalSection(_t51);
					_t39 = WaitForSingleObject(_v16, _v8) - 1;
					if(_t39 < 0) {
						_v9 = 1;
					} else {
						if(_t39 != 0x101) {
							_v9 = 0;
							SetLastError(0);
						} else {
							_v9 = 0;
							SetLastError(0x5b4);
						}
					}
					EnterCriticalSection(_t51);
					E0043825C(_t61, _t53,  &_v24);
					InterlockedExchangeAdd(_t51 + 4, _t65 - 1);
					 *((intOrPtr*)(_t51 + 8)) = _t65;
					_pop(_t59);
					 *[fs:eax] = _t59;
					_push(0x4383d4);
					return CloseHandle(_v16);
				}
			}

0x004382e8
0x004382e9
0x004382eb
0x004382f1
0x004382f4
0x004382f6
0x00438300
0x004383d0
0x004383de
0x00438306
0x00438308
0x0043830e
0x0043831e
0x00438323
0x00438324
0x00438329
0x0043832c
0x0043832f
0x00438337
0x0043833c
0x0043834d
0x00438353
0x00438365
0x00438368
0x00438381
0x0043836a
0x0043836f
0x00438387
0x0043838d
0x00438371
0x00438371
0x0043837a
0x0043837a
0x0043836f
0x00438393
0x0043839d
0x004383aa
0x004383af
0x004383b4
0x004383b7
0x004383ba
0x004383c8
0x004383c8

APIs

GetCurrentThreadId.KERNEL32 ref: 004382F8
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00438319
InterlockedExchangeAdd.KERNEL32(?,?,00000000,004383C9,?,00000000,00000000,00000000,00000000), ref: 0043834D
LeaveCriticalSection.KERNEL32(?,?,?,00000000,004383C9,?,00000000,00000000,00000000,00000000), ref: 00438353
WaitForSingleObject.KERNEL32(?,?,?,?,?,00000000,004383C9,?,00000000,00000000,00000000,00000000), ref: 00438360
SetLastError.KERNEL32(000005B4,?,?,?,?,?,00000000,004383C9,?,00000000,00000000,00000000,00000000), ref: 0043837A
SetLastError.KERNEL32(00000000,?,?,?,?,?,00000000,004383C9,?,00000000,00000000,00000000,00000000), ref: 0043838D
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,004383C9,?,00000000,00000000,00000000,00000000), ref: 00438393
InterlockedExchangeAdd.KERNEL32(?,?,?,?,?,?,?,?,00000000,004383C9,?,00000000,00000000,00000000,00000000), ref: 004383AA
CloseHandle.KERNEL32(?,004383D4,?,?,?,?,?,00000000,004383C9,?,00000000,00000000,00000000,00000000), ref: 004383C3

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalErrorExchangeInterlockedLastSection$CloseCreateCurrentEnterEventHandleLeaveObjectSingleThreadWait
String ID:
API String ID: 3135347424-0
Opcode ID: a916c01331a0019a29f6e23b7b9fc10a1ab48805dadeae80a72639a450ad185b
Instruction ID: c70eb38195c51234a3d489a95c77ed9be4948a5f39490cc3bdf3266904b91a2f
Opcode Fuzzy Hash: a916c01331a0019a29f6e23b7b9fc10a1ab48805dadeae80a72639a450ad185b
Instruction Fuzzy Hash: E8217571A04348AADB11DFB58C42B9EF7A8DB49704F1484ABF904EB282DA7D9D008769

Uniqueness

Uniqueness Score: -1.00%

Function 00476A14, Relevance: 15.1, APIs: 10, Instructions: 74
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00476A14(intOrPtr _a4) {
				intOrPtr _t27;
				struct HMENU__* _t48;

				_t27 =  *((intOrPtr*)(_a4 - 4));
				if( *((char*)(_t27 + 0x281)) != 0) {
					_t27 =  *((intOrPtr*)(_a4 - 4));
					if(( *(_t27 + 0x280) & 0x00000001) != 0) {
						_t27 =  *((intOrPtr*)(_a4 - 4));
						if( *((char*)(_t27 + 0x287)) != 1) {
							_t48 = GetSystemMenu(E00463AA8( *((intOrPtr*)(_a4 - 4))), 0);
							if( *((char*)( *((intOrPtr*)(_a4 - 4)) + 0x281)) == 3) {
								DeleteMenu(_t48, 0xf130, 0);
								DeleteMenu(_t48, 7, 0x400);
								DeleteMenu(_t48, 5, 0x400);
								DeleteMenu(_t48, 0xf030, 0);
								DeleteMenu(_t48, 0xf020, 0);
								DeleteMenu(_t48, 0xf000, 0);
								return DeleteMenu(_t48, 0xf120, 0);
							}
							if(( *( *((intOrPtr*)(_a4 - 4)) + 0x280) & 0x00000002) == 0) {
								EnableMenuItem(_t48, 0xf020, 1);
							}
							_t27 =  *((intOrPtr*)(_a4 - 4));
							if(( *(_t27 + 0x280) & 0x00000004) == 0) {
								return EnableMenuItem(_t48, 0xf030, 1);
							}
						}
					}
				}
				return _t27;
			}

0x00476a1b
0x00476a25
0x00476a2e
0x00476a38
0x00476a41
0x00476a4b
0x00476a64
0x00476a73
0x00476a7d
0x00476a8a
0x00476a97
0x00476aa4
0x00476ab1
0x00476abe
0x00000000
0x00476acb
0x00476adf
0x00476ae9
0x00476ae9
0x00476af1
0x00476afb
0x00000000
0x00476b05
0x00476afb
0x00476a4b
0x00476a38
0x00476b0c

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00476A5F
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00476A7D
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00476A8A
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00476A97
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00476AA4
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00476AB1
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00476ABE
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 00476ACB
EnableMenuItem.USER32(00000000,0000F020,00000001,00000000,00000000), ref: 00476AE9
EnableMenuItem.USER32(00000000,0000F030,00000001,00000000,00000000), ref: 00476B05

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: d4a28ee8abca000964b8f44fbeab3047ee1386834c477a1828e3f7c66532462e
Instruction ID: aa6c4edb705d38009d5785ab0028eb40a8a7309587a2dbef0b1fd0d291d3eaad
Opcode Fuzzy Hash: d4a28ee8abca000964b8f44fbeab3047ee1386834c477a1828e3f7c66532462e
Instruction Fuzzy Hash: BE2150707857407AE760EA24CC8EF997AD96B0471CF0588A5F6487F6E3C6B8B940971C

Uniqueness

Uniqueness Score: -1.00%

Function 0042A9C0, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119
synchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E0042A9C0(signed int __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				signed int _v9;
				intOrPtr* _v16;
				char _v28;
				void* __ebp;
				long _t31;
				intOrPtr _t38;
				intOrPtr _t57;
				signed char _t63;
				intOrPtr* _t72;
				intOrPtr _t77;
				intOrPtr _t78;
				void* _t84;
				void* _t86;
				intOrPtr _t87;

				_t84 = _t86;
				_t87 = _t86 + 0xffffffe8;
				_v9 = __ecx;
				_v8 = __edx;
				_t31 = GetCurrentThreadId();
				_t72 =  *0x506070; // 0x50703c
				if(_t31 !=  *_t72) {
					if(_v9 == 0) {
						_v16 =  &_v28;
					} else {
						_v16 = E00403018(0xc);
					}
					_t63 = _v9 & 0x000000ff ^ 0x00000001;
					if(_t63 == 0) {
						 *(_v16 + 8) = 0;
					} else {
						 *(_v16 + 8) = CreateEventW(0, 0xffffffff, 0, 0);
					}
					_push(_t84);
					_push(0x42ab5d);
					_push( *[fs:eax]);
					 *[fs:eax] = _t87;
					EnterCriticalSection(0x50be80);
					_push(_t84);
					_push(0x42ab36);
					_push( *[fs:eax]);
					 *[fs:eax] = _t87;
					 *((char*)(_v16 + 4)) = _v9 & 0x000000ff;
					if( *0x503ec8 == 0) {
						 *0x503ec8 = E00404068(1);
					}
					 *_v16 = _v8;
					_t38 =  *0x503ec8; // 0x0
					E0042342C(_t38, _v16);
					E0042A3D8();
					if( *0x503eb6 != 0) {
						 *0x503eb4();
					}
					if(_t63 == 0) {
						_pop(_t77);
						 *[fs:eax] = _t77;
						_push(0x42ab3d);
						LeaveCriticalSection(0x50be80);
						return 0;
					} else {
						LeaveCriticalSection(0x50be80);
						_push(_t84);
						_push(0x42ab17);
						_push( *[fs:eax]);
						 *[fs:eax] = _t87;
						WaitForSingleObject( *(_v16 + 8), 0xffffffff);
						_pop(_t78);
						 *[fs:eax] = _t78;
						_push(0x42ab1e);
						EnterCriticalSection(0x50be80);
						return 0;
					}
				} else {
					if( *((short*)(_v8 + 0xa)) == 0) {
						_t57 = _v8;
						if( *((intOrPtr*)(_t57 + 0x10)) != 0) {
							_t57 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x10)))) + 0xc))();
						}
					} else {
						_t57 =  *((intOrPtr*)(_v8 + 8))();
					}
					return _t57;
				}
			}

0x0042a9c1
0x0042a9c3
0x0042a9c7
0x0042a9ca
0x0042a9cd
0x0042a9d2
0x0042a9da
0x0042aa15
0x0042aa29
0x0042aa17
0x0042aa21
0x0042aa21
0x0042aa30
0x0042aa35
0x0042aa51
0x0042aa37
0x0042aa47
0x0042aa47
0x0042aa56
0x0042aa57
0x0042aa5c
0x0042aa5f
0x0042aa67
0x0042aa6e
0x0042aa6f
0x0042aa74
0x0042aa77
0x0042aa81
0x0042aa8b
0x0042aa99
0x0042aa99
0x0042aaa4
0x0042aaa9
0x0042aaae
0x0042aab3
0x0042aac0
0x0042aacf
0x0042aacf
0x0042aad7
0x0042ab20
0x0042ab23
0x0042ab26
0x0042ab30
0x0042ab35
0x0042aad9
0x0042aade
0x0042aae5
0x0042aae6
0x0042aaeb
0x0042aaee
0x0042aafa
0x0042ab01
0x0042ab04
0x0042ab07
0x0042ab11
0x0042ab16
0x0042ab16
0x0042a9dc
0x0042a9e4
0x0042a9f4
0x0042a9fb
0x0042aa09
0x0042aa09
0x0042a9e6
0x0042a9ec
0x0042a9ec
0x0042ab82
0x0042ab82

APIs

GetCurrentThreadId.KERNEL32 ref: 0042A9CD
CreateEventW.KERNEL32(00000000,000000FF,00000000,00000000), ref: 0042AA3F
EnterCriticalSection.KERNEL32(0050BE80,00000000,0042AB5D), ref: 0042AA67
LeaveCriticalSection.KERNEL32(0050BE80,00000000,0042AB36,?,0050BE80,00000000,0042AB5D), ref: 0042AADE
WaitForSingleObject.KERNEL32(?,000000FF,00000000,0042AB17,?,0050BE80,00000000,0042AB36,?,0050BE80,00000000,0042AB5D), ref: 0042AAFA
EnterCriticalSection.KERNEL32(0050BE80,0042AB1E,0042AB17,?,0050BE80,00000000,0042AB36,?,0050BE80,00000000,0042AB5D), ref: 0042AB11

Strings

<pP, xrefs: 0042A9D2

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Enter$CreateCurrentEventLeaveObjectSingleThreadWait
String ID: <pP
API String ID: 1504017990-2523196900
Opcode ID: e15ce99b25193f57422479ed01383beb6fe1f602111450dadc28738b056f5ab7
Instruction ID: 16198e3c9d85fb44e54a7d3473107cc41a06f1555705ca15c60ef58a7d1e51d8
Opcode Fuzzy Hash: e15ce99b25193f57422479ed01383beb6fe1f602111450dadc28738b056f5ab7
Instruction Fuzzy Hash: CA41DE30B04204EFD711DF65E881E5DBBB9EF49300F9581A6EC04AB3A2C3B9AD54DB16

Uniqueness

Uniqueness Score: -1.00%

Function 004B1DE0, Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E004B1DE0(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr _t33;
				intOrPtr* _t37;
				intOrPtr* _t49;
				intOrPtr _t61;
				intOrPtr* _t66;
				void* _t68;
				intOrPtr _t70;
				intOrPtr _t71;

				_t70 = _t71;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t68 = __eax;
				_push(_t70);
				_push(0x4b1efa);
				_push( *[fs:eax]);
				 *[fs:eax] = _t71;
				_t66 = E00409620(__ebx, _t68, GetModuleHandleW(L"OLEAUT32.DLL"), L"UnRegisterTypeLib");
				_t49 = _t66;
				if(_t66 == 0) {
					E004ADFA0(L"GetProcAddress");
				}
				E0047E754(_t68,  &_v20);
				E004066BC( &_v8, _v20);
				_push(E0040880C( &_v12));
				_t28 = E00406014(_v8);
				_push(_t28);
				L00415184();
				if(_t28 != 0) {
					E004ADFB4(L"LoadTypeLib", _t49, _t28, _t68);
				}
				_push( &_v16);
				_t30 = _v12;
				_push(_t30);
				if( *((intOrPtr*)( *_t30 + 0x1c))() != 0) {
					E004ADFB4(L"ITypeLib::GetLibAttr", _t49, _t32, _t68);
				}
				_push(_t70);
				_push(0x4b1ecd);
				_push( *[fs:edx]);
				 *[fs:edx] = _t71;
				_t33 = _v16;
				_push( *((intOrPtr*)(_t33 + 0x14)));
				_push( *((intOrPtr*)(_t33 + 0x10)));
				_push( *(_t33 + 0x1a) & 0x0000ffff);
				_push( *(_t33 + 0x18) & 0x0000ffff);
				_push(_t33);
				if( *_t49() != 0) {
					E004ADFB4(L"UnRegisterTypeLib", _t49, _t34, _t68);
				}
				_pop(_t61);
				 *[fs:eax] = _t61;
				_t37 = _v12;
				return  *((intOrPtr*)( *_t37 + 0x30))(_t37, _v16, E004B1ED4);
			}

0x004b1de1
0x004b1de5
0x004b1de6
0x004b1de7
0x004b1de8
0x004b1de9
0x004b1dea
0x004b1dec
0x004b1df0
0x004b1df1
0x004b1df6
0x004b1df9
0x004b1e11
0x004b1e13
0x004b1e17
0x004b1e1e
0x004b1e1e
0x004b1e28
0x004b1e33
0x004b1e40
0x004b1e44
0x004b1e49
0x004b1e4a
0x004b1e51
0x004b1e5a
0x004b1e5a
0x004b1e62
0x004b1e63
0x004b1e66
0x004b1e6e
0x004b1e77
0x004b1e77
0x004b1e7e
0x004b1e7f
0x004b1e84
0x004b1e87
0x004b1e8a
0x004b1e90
0x004b1e94
0x004b1e99
0x004b1e9e
0x004b1e9f
0x004b1ea4
0x004b1ead
0x004b1ead
0x004b1eb4
0x004b1eb7
0x004b1ec3
0x004b1ecc

APIs

GetModuleHandleW.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,004B1EFA,?,?,?,00000000,00000000,00000000,00000000,00000000,?,004B6CF5,00000000,004B6D09), ref: 004B1E06

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

LoadTypeLib.OLEAUT32(00000000,00000000,00000000,OLEAUT32.DLL,UnRegisterTypeLib,00000000,004B1EFA,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 004B1E4A

Part of subcall function 004ADFA0: GetLastError.KERNEL32(00000000,004AEC5A,00000005,00000000,004AEC82,?,?,00000000,0050C17C,00000000,00000000,00000000,?,004FFFA7,00000000,004FFFC2), ref: 004ADFA3

Strings

GetProcAddress, xrefs: 004B1E19
UnRegisterTypeLib, xrefs: 004B1EA8
ITypeLib::GetLibAttr, xrefs: 004B1E72
UnRegisterTypeLib, xrefs: 004B1DFC
OLEAUT32.DLL, xrefs: 004B1E01
LoadTypeLib, xrefs: 004B1E55

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: 95dbabcd373eaff2a86a458583bf233d2a4e559d93850d86db7c12e9cbbdb915
Instruction ID: c427ab35b2bc6fcf8139a907bf01828608d32d6f9ce052de0c63d5a4f3dc28ff
Opcode Fuzzy Hash: 95dbabcd373eaff2a86a458583bf233d2a4e559d93850d86db7c12e9cbbdb915
Instruction Fuzzy Hash: 0D216D71A00104AFDB04EBAACC52DABB7EDEF88704751846AF405D7661EB78ED01C778

Uniqueness

Uniqueness Score: -1.00%

Function 00480394, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82
registryCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00480394(void* __ebx, void* __esi, void* __eflags) {
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				intOrPtr* _t21;
				intOrPtr* _t22;
				intOrPtr _t61;
				void* _t68;

				_push(__ebx);
				_v20 = 0;
				_v8 = 0;
				_push(_t68);
				_push(0x48048e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t68 + 0xfffffff0;
				_t21 = E00409620(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"GetUserDefaultUILanguage");
				if(_t21 == 0) {
					_t22 =  *0x50605c; // 0x503914
					if( *_t22 != 2) {
						if(E0047FDB8(0, L"Control Panel\\Desktop\\ResourceLocale", 0x80000001,  &_v12, 1, 0) == 0) {
							E0047FCE0();
							RegCloseKey(_v12);
						}
					} else {
						if(E0047FDB8(0, L".DEFAULT\\Control Panel\\International", 0x80000003,  &_v12, 1, 0) == 0) {
							E0047FCE0();
							RegCloseKey(_v12);
						}
					}
					E00406914( &_v20, _v8, 0x4805a4);
					E00403648(_v20,  &_v16);
					if(_v16 != 0) {
					}
				} else {
					 *_t21();
				}
				_pop(_t61);
				 *[fs:eax] = _t61;
				_push(E00480495);
				L00406438( &_v20);
				return L00406438( &_v8);
			}

0x0048039a
0x0048039d
0x004803a0
0x004803a5
0x004803a6
0x004803ab
0x004803ae
0x004803c1
0x004803c8
0x004803d3
0x004803db
0x00480430
0x0048043d
0x00480446
0x00480446
0x004803dd
0x004803f8
0x00480405
0x0048040e
0x0048040e
0x004803f8
0x00480456
0x00480461
0x0048046c
0x0048046c
0x004803ca
0x004803ca
0x004803cc
0x00480472
0x00480475
0x00480478
0x00480480
0x0048048d

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0048048E,?,00000000), ref: 004803BB

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

RegCloseKey.ADVAPI32(00000001,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0048048E,?,00000000), ref: 0048040E

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 0048041D
Locale, xrefs: 004803FD
kernel32.dll, xrefs: 004803B6
.DEFAULT\Control Panel\International, xrefs: 004803E5
GetUserDefaultUILanguage, xrefs: 004803B1

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 79b59476654b9c1e2545a1cd3757bc18427b33616edf7b6aa5f3327d2d57dc9e
Instruction ID: 5a8d868fca1db48a597d2c11827b26e6b2551b50d5d5d82d1396ffff031fe2ad
Opcode Fuzzy Hash: 79b59476654b9c1e2545a1cd3757bc18427b33616edf7b6aa5f3327d2d57dc9e
Instruction Fuzzy Hash: EA217630A50208AFDB50FBA5CC51BDF73A8AB44704F608C7AA504E7281E77C9E09CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00404FF4, Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 38
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00404FF4(void* __ecx) {
				long _v4;
				int _t3;

				if( *0x507054 == 0) {
					if( *0x503030 == 0) {
						_t3 = MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
					}
					return _t3;
				} else {
					if( *0x507330 == 0xd7b2 &&  *0x507338 > 0) {
						 *0x507348();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1d,  &_v4, 0);
					return WriteFile(GetStdHandle(0xfffffff5), E00405080, 2,  &_v4, 0);
				}
			}

0x00404ffc
0x0040505c
0x0040506c
0x0040506c
0x00405072
0x00404ffe
0x00405007
0x00405017
0x00405017
0x00405033
0x00405054
0x00405054

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004050A5,?,?,?,00000002,004051BA,00403127,0040316E,?,00000000), ref: 0040502D
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004050A5,?,?,?,00000002,004051BA,00403127,0040316E,?), ref: 00405033
GetStdHandle.KERNEL32(000000F5,00405080,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004050A5), ref: 00405048
WriteFile.KERNEL32(00000000,000000F5,00405080,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,004050A5), ref: 0040504E
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000,?,004050A5,?,?,?,00000002,004051BA,00403127,0040316E,?,00000000), ref: 0040506C

Strings

Runtime error at 00000000, xrefs: 00405026, 00405065
Error, xrefs: 00405060
,sP, xrefs: 00405012

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite$Message
String ID: ,sP$Error$Runtime error at 00000000
API String ID: 1570097196-1156853235
Opcode ID: 1b222cc4e24fd7c6f5cec4bc43e63ff6bdb54c1d1e6ae853ac47c940ceeef3be
Instruction ID: c2096004adac698ad6d27b6f8c024941c7ef1dfbd4438167a4a5939095506d9e
Opcode Fuzzy Hash: 1b222cc4e24fd7c6f5cec4bc43e63ff6bdb54c1d1e6ae853ac47c940ceeef3be
Instruction Fuzzy Hash: AAF0F6A1A5834478FB20B3644C46FDF2A5CD344F14F10066FBA10B50E383B855C8AAA9

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD90, Relevance: 13.7, APIs: 9, Instructions: 154
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0045AD90(intOrPtr* __eax, int __ecx, int __edx) {
				signed int _t58;
				signed char _t108;
				int _t121;
				intOrPtr* _t122;
				int _t123;
				int* _t125;

				 *_t125 = __ecx;
				_t121 = __edx;
				_t122 = __eax;
				if(__edx ==  *_t125) {
					L29:
					_t58 =  *0x45af50 & 0x000000ff;
					 *(_t122 + 0x88) = _t58;
					return _t58;
				}
				if(( *(__eax + 0x1c) & 0x00000001) == 0) {
					_t108 =  *0x45af48 & 0x000000ff;
				} else {
					_t108 =  *(__eax + 0x88) & 0x000000ff;
				}
				if((_t108 & 0x00000001) == 0) {
					_t123 =  *(_t122 + 0x40);
				} else {
					_t123 = MulDiv( *(_t122 + 0x40), _t121,  *_t125);
				}
				if((_t108 & 0x00000002) == 0) {
					_t125[1] =  *(_t122 + 0x44);
				} else {
					_t125[1] = MulDiv( *(_t122 + 0x44), _t121,  *_t125);
				}
				if((_t108 & 0x00000004) == 0 || ( *(_t122 + 0x51) & 0x00000001) != 0) {
					_t125[2] =  *(_t122 + 0x48);
				} else {
					if((_t108 & 0x00000001) == 0) {
						_t125[2] = MulDiv( *(_t122 + 0x48), _t121,  *_t125);
					} else {
						_t125[2] = MulDiv( *(_t122 + 0x40) +  *(_t122 + 0x48), _t121,  *_t125) - _t123;
					}
				}
				if((_t108 & 0x00000008) == 0 || ( *(_t122 + 0x51) & 0x00000002) != 0) {
					_t125[3] =  *(_t122 + 0x4c);
				} else {
					if((_t108 & 0x00000002) == 0) {
						_t125[3] = MulDiv( *(_t122 + 0x4c), _t121,  *_t125);
					} else {
						_t125[3] = MulDiv( *(_t122 + 0x44) +  *(_t122 + 0x4c), _t121,  *_t125) - _t125[1];
					}
				}
				E0045ABB0(_t122,  *_t125, _t121);
				E0045AC34(_t122,  *_t125, _t121);
				 *((intOrPtr*)( *_t122 + 0x88))(_t125[4], _t125[2]);
				if(( *0x45af50 & 0x000000ff) != (_t108 &  *0x45af4c)) {
					 *(_t122 + 0x184) = MulDiv( *(_t122 + 0x184), _t121,  *_t125);
				}
				if(( *0x45af50 & 0x000000ff) != (_t108 &  *0x45af54)) {
					 *(_t122 + 0x188) = MulDiv( *(_t122 + 0x188), _t121,  *_t125);
				}
				if( *((char*)(_t122 + 0x59)) == 0 && (_t108 & 0x00000010) != 0) {
					E00431170( *((intOrPtr*)(_t122 + 0x64)), MulDiv(E00431154( *((intOrPtr*)(_t122 + 0x64))), _t121,  *_t125));
				}
				goto L29;
			}

0x0045ad97
0x0045ad9a
0x0045ad9c
0x0045ada1
0x0045af30
0x0045af30
0x0045af37
0x0045af44
0x0045af44
0x0045adab
0x0045adb6
0x0045adad
0x0045adad
0x0045adad
0x0045adc0
0x0045add4
0x0045adc2
0x0045add0
0x0045add0
0x0045adda
0x0045adf3
0x0045addc
0x0045adea
0x0045adea
0x0045adfa
0x0045ae37
0x0045ae02
0x0045ae05
0x0045ae2e
0x0045ae07
0x0045ae1a
0x0045ae1a
0x0045ae05
0x0045ae3e
0x0045ae7d
0x0045ae46
0x0045ae49
0x0045ae74
0x0045ae4b
0x0045ae60
0x0045ae60
0x0045ae49
0x0045ae88
0x0045ae94
0x0045aead
0x0045aec4
0x0045aed7
0x0045aed7
0x0045aeee
0x0045af01
0x0045af01
0x0045af0b
0x0045af2b
0x0045af2b
0x00000000

APIs

MulDiv.KERNEL32(?,?,?), ref: 0045ADCB
MulDiv.KERNEL32(?,?,?), ref: 0045ADE5
MulDiv.KERNEL32(?,?,?), ref: 0045AE13
MulDiv.KERNEL32(?,?,?), ref: 0045AE29
MulDiv.KERNEL32(?,?,?), ref: 0045AE57
MulDiv.KERNEL32(?,?,?), ref: 0045AE6F

Part of subcall function 00431154: MulDiv.KERNEL32(00000000,00000048,?,?,00430D22,00000000,00430D42,?,00000000,00430D5F), ref: 00431165

MulDiv.KERNEL32(?), ref: 0045AED2
MulDiv.KERNEL32(?), ref: 0045AEFC
MulDiv.KERNEL32(00000000), ref: 0045AF22

Part of subcall function 00431170: MulDiv.KERNEL32(00000000,?,00000048,?,?,00430D2C,00000000,00430D42,?,00000000,00430D5F), ref: 0043117D

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d862947c6e7b4d337c8c14e877dcca981f13212eb05dcb82cc5eb7d8e0c86000
Instruction ID: f1f6fd2c556ab00322e5940bd2638ac3675085c17332793a79ac2b197e814537
Opcode Fuzzy Hash: d862947c6e7b4d337c8c14e877dcca981f13212eb05dcb82cc5eb7d8e0c86000
Instruction Fuzzy Hash: 9F516FB1604750AFC720DB29C885A6BF7E9AF49305F04491EB9D6C7363C638EC58CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 004B33C0, Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E004B33C0(char __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				char _v12;
				char _v13;
				char _v84;
				void* _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				void* _t58;
				void* _t91;
				char _t92;
				intOrPtr _t110;
				void* _t120;
				void* _t123;

				_t118 = __edi;
				_v116 = 0;
				_v120 = 0;
				_v112 = 0;
				_v108 = 0;
				_v104 = 0;
				_v8 = 0;
				_v12 = 0;
				_t120 = __ecx;
				_t91 = __edx;
				_v13 = __eax;
				_push(_t123);
				_push(0x4b3554);
				_push( *[fs:eax]);
				 *[fs:eax] = _t123 + 0xffffff84;
				E0047F7D8( &_v8);
				_push(0x4b3570);
				E0047E328(_v8,  &_v104);
				_push(_v104);
				_push(L"regsvr32.exe\"");
				E004069F8( &_v12, 3, __edi);
				if(_v13 != 0) {
					E00406854( &_v12, 0x4b35a8);
				}
				_push(_v12);
				_push(L" /s \"");
				_push(_t120);
				_push(0x4b3570);
				E004069F8( &_v12, 4, _t118);
				_t126 = _t91;
				if(_t91 == 0) {
					E00406914( &_v112, _v12, L"Spawning 32-bit RegSvr32: ");
					E004B2F34(_v112, _t91, _v12, _t118, _t120);
				} else {
					E00406914( &_v108, _v12, L"Spawning 64-bit RegSvr32: ");
					E004B2F34(_v108, _t91, _v12, _t118, _t120);
				}
				E00403540( &_v84, 0x44);
				_v84 = 0x44;
				_t58 = E004064D4(_v8);
				if(E004AD388(_t91, E004064D4(_v12), 0, _t126,  &_v100,  &_v84, _t58, 0, 0x4000000, 0, 0, 0) == 0) {
					E004ADFA0(L"CreateProcess");
				}
				CloseHandle(_v96);
				_t92 = E004B32BC( &_v100);
				if(_t92 != 0) {
					_v128 = _t92;
					_v124 = 0;
					E0040E2C8(L"0x%x", 0,  &_v128,  &_v120);
					E004ABEA8(0x45,  &_v116, _v120);
					E004119A0(_v116, 1);
					E00404A74();
				}
				_pop(_t110);
				 *[fs:eax] = _t110;
				_push(E004B355B);
				L00406440( &_v120, 5);
				return L00406440( &_v12, 2);
			}

0x004b33c0
0x004b33ca
0x004b33cd
0x004b33d0
0x004b33d3
0x004b33d6
0x004b33d9
0x004b33dc
0x004b33df
0x004b33e1
0x004b33e3
0x004b33e8
0x004b33e9
0x004b33ee
0x004b33f1
0x004b33f7
0x004b33fc
0x004b3407
0x004b340c
0x004b340f
0x004b341c
0x004b3425
0x004b342f
0x004b342f
0x004b3434
0x004b3437
0x004b343c
0x004b343d
0x004b344a
0x004b344f
0x004b3451
0x004b3478
0x004b3480
0x004b3453
0x004b345e
0x004b3466
0x004b3466
0x004b348f
0x004b3494
0x004b34ab
0x004b34ce
0x004b34d5
0x004b34d5
0x004b34de
0x004b34eb
0x004b34ef
0x004b34f5
0x004b34f8
0x004b3506
0x004b3513
0x004b3522
0x004b3527
0x004b3527
0x004b352e
0x004b3531
0x004b3534
0x004b3541
0x004b3553

APIs

Part of subcall function 0047F7D8: GetSystemDirectoryW.KERNEL32(?,00000104,?,004FF876,00000000,004FFA91,?,?,00000005,00000000,004FFACA,?,?,00000000,?), ref: 0047F7EB

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,004B3570,000000EC, /s ",?,regsvr32.exe",?,004B3570), ref: 004B34DE

Strings

regsvr32.exe", xrefs: 004B340F
0x%x, xrefs: 004B3501
Spawning 32-bit RegSvr32: , xrefs: 004B3473
CreateProcess, xrefs: 004B34D0
D, xrefs: 004B3494
/u, xrefs: 004B342A
Spawning 64-bit RegSvr32: , xrefs: 004B3459
/s ", xrefs: 004B3437

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: 545cf6890f215744bb073db01184fe47b07b1107b0506e0eddefa9348886ca14
Instruction ID: 66470d0e057ef8df61b96813a2ebe9a37a8d71f0f185da314ceb33c2d0a7dc85
Opcode Fuzzy Hash: 545cf6890f215744bb073db01184fe47b07b1107b0506e0eddefa9348886ca14
Instruction Fuzzy Hash: C0412770A00348ABDB14EFE6C881BDDB7B9AF48304F61417FA505B7681D7786A05CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0045BDE8, Relevance: 13.6, APIs: 9, Instructions: 122
windowCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0045BDE8(void* __ebx, char __ecx, intOrPtr* __edx, void* __edi, void* __esi) {
				char _v5;
				struct HWND__* _v12;
				struct HDC__* _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				int _v32;
				int _v36;
				int _t76;
				intOrPtr _t82;
				int _t85;
				void* _t90;
				int _t91;
				void* _t94;
				void* _t95;
				intOrPtr _t96;

				_t94 = _t95;
				_t96 = _t95 + 0xffffffe0;
				_v5 = __ecx;
				_t76 =  *((intOrPtr*)( *__edx + 0x38))();
				if(_v5 == 0) {
					_push(__edx);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_pop(_t90);
				} else {
					_push(__edx);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_pop(_t90);
				}
				_v12 = GetDesktopWindow();
				_v16 = GetDCEx(_v12, 0, 0x402);
				_push(_t94);
				_push(0x45bf03);
				_push( *[fs:eax]);
				 *[fs:eax] = _t96;
				_v20 = SelectObject(_v16, E004317A4( *((intOrPtr*)(_t90 + 0x48))));
				_t91 = _v36;
				_t85 = _v32;
				PatBlt(_v16, _t91 + _t76, _t85, _v28 - _t91 - _t76, _t76, 0x5a0049);
				PatBlt(_v16, _v28 - _t76, _t85 + _t76, _t76, _v24 - _t85 - _t76, 0x5a0049);
				PatBlt(_v16, _t91, _v24 - _t76, _v28 - _v36 - _t76, _t76, 0x5a0049);
				PatBlt(_v16, _t91, _t85, _t76, _v24 - _v32 - _t76, 0x5a0049);
				SelectObject(_v16, _v20);
				_pop(_t82);
				 *[fs:eax] = _t82;
				_push(0x45bf0a);
				return ReleaseDC(_v12, _v16);
			}

0x0045bde9
0x0045bdeb
0x0045bdf1
0x0045bdfd
0x0045be03
0x0045be13
0x0045be1a
0x0045be1b
0x0045be1c
0x0045be1d
0x0045be1e
0x0045be05
0x0045be05
0x0045be0c
0x0045be0d
0x0045be0e
0x0045be0f
0x0045be10
0x0045be10
0x0045be24
0x0045be37
0x0045be3c
0x0045be3d
0x0045be42
0x0045be45
0x0045be5a
0x0045be66
0x0045be6e
0x0045be7b
0x0045be9d
0x0045bebc
0x0045bed6
0x0045bee3
0x0045beea
0x0045beed
0x0045bef0
0x0045bf02

APIs

GetDesktopWindow.USER32 ref: 0045BE1F
GetDCEx.USER32(?,00000000,00000402), ref: 0045BE32
SelectObject.GDI32(?,00000000,00000000,0045BF03,?,?,00000000,00000402), ref: 0045BE55
PatBlt.GDI32(?,?,?,?,00000000,005A0049,?,00000000,00000000,0045BF03,?,?,00000000,00000402), ref: 0045BE7B
PatBlt.GDI32(?,?,?,00000000,?,005A0049,?,?,?,?,00000000,005A0049,?,00000000,00000000,0045BF03), ref: 0045BE9D
PatBlt.GDI32(?,?,?,?,00000000,005A0049,?,?,?,00000000,?,005A0049,?,?,?,?), ref: 0045BEBC
PatBlt.GDI32(?,?,?,00000000,?,005A0049,?,?,?,?,00000000,005A0049,?,?,?,00000000), ref: 0045BED6
SelectObject.GDI32(?,?,?,?,?,00000000,?,005A0049,?,?,?,?,00000000,005A0049,?,?), ref: 0045BEE3
ReleaseDC.USER32(?,?,0045BF0A,?,?,00000000,?,005A0049,?,?,?,?,00000000,005A0049,?,?), ref: 0045BEFD

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectSelect$DesktopReleaseWindow
String ID:
API String ID: 1187665388-0
Opcode ID: 99059c9a72475d8b37fba6d549eb90e805120b3a96c17622a23b8ea3aa1c0bf7
Instruction ID: accca273f27da4cbd73beaaa223f1d6d6570a2e3220156721b0fc9de4b6beb3d
Opcode Fuzzy Hash: 99059c9a72475d8b37fba6d549eb90e805120b3a96c17622a23b8ea3aa1c0bf7
Instruction Fuzzy Hash: D231FC76A00659AFDB00DEEDCC85DAFB7FCEF49704B004469B504F7252C6799D048BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00413000, Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 203
threadCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00413000(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				void* _t104;
				void* _t111;
				void* _t135;
				intOrPtr _t187;
				intOrPtr _t197;
				intOrPtr _t198;

				_t195 = __esi;
				_t194 = __edi;
				_t197 = _t198;
				_t135 = 8;
				do {
					_push(0);
					_push(0);
					_t135 = _t135 - 1;
				} while (_t135 != 0);
				_push(__ebx);
				_push(_t197);
				_push(0x4132de);
				_push( *[fs:eax]);
				 *[fs:eax] = _t198;
				E00412F48();
				E004110E4(__ebx, __edi, __esi);
				_t200 =  *0x509c60;
				if( *0x509c60 != 0) {
					E004112BC(__esi, _t200);
				}
				_t134 = GetThreadLocale();
				E00411030(_t43, 0, 0x14,  &_v20);
				E00406448(0x509b90, _v20);
				E00411030(_t43, 0x4132f8, 0x1b,  &_v24);
				 *0x509b94 = E0040D258(0x4132f8, 0, _t200);
				E00411030(_t134, 0x4132f8, 0x1c,  &_v28);
				 *0x509b95 = E0040D258(0x4132f8, 0, _t200);
				 *0x509b96 = E0041107C(_t134, 0x2c, 0xf);
				 *0x509b98 = E0041107C(_t134, 0x2e, 0xe);
				E00411030(_t134, 0x4132f8, 0x19,  &_v32);
				 *0x509b9a = E0040D258(0x4132f8, 0, _t200);
				 *0x509b9c = E0041107C(_t134, 0x2f, 0x1d);
				E00411030(_t134, L"m/d/yy", 0x1f,  &_v40);
				E00411370(_v40, _t134,  &_v36, _t194, _t195, _t200);
				E00406448(0x509ba0, _v36);
				E00411030(_t134, L"mmmm d, yyyy", 0x20,  &_v48);
				E00411370(_v48, _t134,  &_v44, _t194, _t195, _t200);
				E00406448(0x509ba4, _v44);
				 *0x509ba8 = E0041107C(_t134, 0x3a, 0x1e);
				E00411030(_t134, 0x41334c, 0x28,  &_v52);
				E00406448(0x509bac, _v52);
				E00411030(_t134, 0x413360, 0x29,  &_v56);
				E00406448(0x509bb0, _v56);
				E0040649C( &_v12, 0);
				E0040649C( &_v16, 0);
				E00411030(_t134, 0x4132f8, 0x25,  &_v60);
				_t104 = E0040D258(0x4132f8, 0, _t200);
				_t201 = _t104;
				if(_t104 != 0) {
					E0040649C( &_v8, 0x413384);
				} else {
					E0040649C( &_v8, 0x413374);
				}
				E00411030(_t134, 0x4132f8, 0x23,  &_v64);
				_t111 = E0040D258(0x4132f8, 0, _t201);
				_t202 = _t111;
				if(_t111 == 0) {
					E00411030(_t134, 0x4132f8, 0x1005,  &_v68);
					if(E0040D258(0x4132f8, 0, _t202) != 0) {
						E0040649C( &_v12, L"AMPM ");
					} else {
						E0040649C( &_v16, L" AMPM");
					}
				}
				_push(_v12);
				_push(_v8);
				_push(":mm");
				_push(_v16);
				E004069F8(0x509bb4, 4, _t194);
				_push(_v12);
				_push(_v8);
				_push(L":mm:ss");
				_push(_v16);
				E004069F8(0x509bb8, 4, _t194);
				 *0x509c62 = E0041107C(_t134, 0x2c, 0xc);
				_pop(_t187);
				 *[fs:eax] = _t187;
				_push(0x4132e5);
				return L00406440( &_v68, 0x10);
			}

0x00413000
0x00413000
0x00413001
0x00413003
0x00413008
0x00413008
0x0041300a
0x0041300c
0x0041300c
0x0041300f
0x00413012
0x00413013
0x00413018
0x0041301b
0x0041301e
0x00413023
0x00413028
0x0041302f
0x00413031
0x00413031
0x0041303b
0x0041304a
0x00413057
0x0041306c
0x0041307b
0x00413090
0x0041309f
0x004130b4
0x004130ca
0x004130e0
0x004130ef
0x00413104
0x0041311a
0x00413125
0x00413132
0x00413147
0x00413152
0x0041315f
0x00413174
0x0041318a
0x00413197
0x004131ac
0x004131b9
0x004131c3
0x004131cd
0x004131e2
0x004131ec
0x004131f1
0x004131f3
0x0041320c
0x004131f5
0x004131fd
0x004131fd
0x00413221
0x0041322b
0x00413230
0x00413232
0x00413244
0x00413255
0x0041326e
0x00413257
0x0041325f
0x0041325f
0x00413255
0x00413273
0x00413276
0x00413279
0x0041327e
0x0041328b
0x00413290
0x00413293
0x00413296
0x0041329b
0x004132a8
0x004132bd
0x004132c5
0x004132c8
0x004132cb
0x004132dd

APIs

GetThreadLocale.KERNEL32(00000000,004132DE,?,?,00000000,00000000), ref: 00413036

Part of subcall function 00411030: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041104E

Strings

AMPM , xrefs: 00413269
:mm, xrefs: 00413279
:mm:ss, xrefs: 00413296
m/d/yy, xrefs: 0041310E
AMPM, xrefs: 0041325A
mmmm d, yyyy, xrefs: 0041313B

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 04d14b7cda353f85f8fcb963e5a6aa7478de87569502722b96b7bd60c6938d81
Instruction ID: 41c47d3963b635f9c798e8be6f628133aadf544caf7e720eedbfde4f43845819
Opcode Fuzzy Hash: 04d14b7cda353f85f8fcb963e5a6aa7478de87569502722b96b7bd60c6938d81
Instruction Fuzzy Hash: 5171B630B101489BD700FFA5D842BDEB7A6EB48344F50807BB601AB79ACA3DDE85975D

Uniqueness

Uniqueness Score: -1.00%

Function 00416A54, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00416A54(short* __eax, intOrPtr __ecx, signed short* __edx) {
				char _v260;
				char _v768;
				char _v772;
				short* _v776;
				intOrPtr _v780;
				char _v784;
				signed int _v788;
				signed short* _v792;
				char _v796;
				char _v800;
				intOrPtr* _v804;
				void* __ebp;
				signed char _t47;
				signed int _t54;
				void* _t62;
				intOrPtr* _t73;
				signed short* _t91;
				void* _t93;
				void* _t95;
				void* _t98;
				void* _t99;
				intOrPtr* _t108;
				void* _t112;
				intOrPtr _t113;
				char* _t114;
				void* _t115;

				_t100 = __ecx;
				_v780 = __ecx;
				_t91 = __edx;
				_v776 = __eax;
				if(( *(__edx + 1) & 0x00000020) == 0) {
					E004165E4(0x80070057);
				}
				_t47 =  *_t91 & 0x0000ffff;
				if((_t47 & 0x00000fff) != 0xc) {
					_push(_t91);
					_push(_v776);
					L004151B4();
					return E004165E4(_v776);
				} else {
					if((_t47 & 0x00000040) == 0) {
						_v792 = _t91[4];
					} else {
						_v792 =  *(_t91[4]);
					}
					_v788 =  *_v792 & 0x0000ffff;
					_t93 = _v788 - 1;
					if(_t93 < 0) {
						L9:
						_push( &_v772);
						_t54 = _v788;
						_push(_t54);
						_push(0xc);
						L00415614();
						_t113 = _t54;
						if(_t113 == 0) {
							E0041633C(_t100);
						}
						E004169AC(_v776);
						 *_v776 = 0x200c;
						 *((intOrPtr*)(_v776 + 8)) = _t113;
						_t95 = _v788 - 1;
						if(_t95 < 0) {
							L14:
							_t97 = _v788 - 1;
							if(E004169C8(_v788 - 1, _t115) != 0) {
								L0041563C();
								E004165E4(_v792);
								L0041563C();
								E004165E4( &_v260);
								_v780(_t113,  &_v260,  &_v800, _v792,  &_v260,  &_v796);
							}
							_t62 = E004169F8(_t97, _t115);
						} else {
							_t98 = _t95 + 1;
							_t73 =  &_v768;
							_t108 =  &_v260;
							do {
								 *_t108 =  *_t73;
								_t108 = _t108 + 4;
								_t73 = _t73 + 8;
								_t98 = _t98 - 1;
							} while (_t98 != 0);
							do {
								goto L14;
							} while (_t62 != 0);
							return _t62;
						}
					} else {
						_t99 = _t93 + 1;
						_t112 = 0;
						_t114 =  &_v772;
						do {
							_v804 = _t114;
							_push(_v804 + 4);
							_t18 = _t112 + 1; // 0x1
							_push(_v792);
							L0041561C();
							E004165E4(_v792);
							_push( &_v784);
							_t21 = _t112 + 1; // 0x1
							_push(_v792);
							L00415624();
							E004165E4(_v792);
							 *_v804 = _v784 -  *((intOrPtr*)(_v804 + 4)) + 1;
							_t112 = _t112 + 1;
							_t114 = _t114 + 8;
							_t99 = _t99 - 1;
						} while (_t99 != 0);
						goto L9;
					}
				}
			}

0x00416a54
0x00416a60
0x00416a66
0x00416a68
0x00416a72
0x00416a79
0x00416a79
0x00416a7e
0x00416a8c
0x00416c05
0x00416c0c
0x00416c0d
0x00000000
0x00416a92
0x00416a95
0x00416aa7
0x00416a97
0x00416a9c
0x00416a9c
0x00416ab6
0x00416ac2
0x00416ac5
0x00416b32
0x00416b38
0x00416b39
0x00416b3f
0x00416b40
0x00416b42
0x00416b47
0x00416b4b
0x00416b4d
0x00416b4d
0x00416b58
0x00416b63
0x00416b6e
0x00416b77
0x00416b7a
0x00416b96
0x00416b9d
0x00416ba8
0x00416bbf
0x00416bc4
0x00416bd8
0x00416bdd
0x00416bf0
0x00416bf0
0x00416bf9
0x00416b7c
0x00416b7c
0x00416b7d
0x00416b83
0x00416b89
0x00416b8b
0x00416b8d
0x00416b90
0x00416b93
0x00416b93
0x00416b96
0x00000000
0x00000000
0x00000000
0x00416b96
0x00416ac7
0x00416ac7
0x00416ac8
0x00416aca
0x00416ad0
0x00416ad2
0x00416ae1
0x00416ae2
0x00416aec
0x00416aed
0x00416af2
0x00416afd
0x00416afe
0x00416b08
0x00416b09
0x00416b0e
0x00416b29
0x00416b2b
0x00416b2c
0x00416b2f
0x00416b2f
0x00000000
0x00416ad0
0x00416ac5

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00416AED
SafeArrayGetUBound.OLEAUT32(?,00000001,?,?,00000001,?), ref: 00416B09
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 00416B42
SafeArrayPtrOfIndex.OLEAUT32(?,?,?,0000000C,?,?), ref: 00416BBF
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?,?,?,?,0000000C,?,?), ref: 00416BD8
VariantCopy.OLEAUT32(?), ref: 00416C0D

Strings

, xrefs: 00416A6E

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: cb83866fc7136a6878018b286a1c02c2e34de7550b6684809434eb0022da1d5c
Instruction ID: e696b43ff3f98e788a9d9282865cc97d600581cf0e4635d1bb05b8f994a43ddd
Opcode Fuzzy Hash: cb83866fc7136a6878018b286a1c02c2e34de7550b6684809434eb0022da1d5c
Instruction Fuzzy Hash: 27511DB5A016299BCB22DB59C980BD9B3BDAF48304F0141DAF548E7206D634EFC48F69

Uniqueness

Uniqueness Score: -1.00%

Function 0042A3FC, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119
threadCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E0042A3FC(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v5;
				intOrPtr* _v12;
				long _v16;
				char _v20;
				char _v24;
				long _t27;
				char _t34;
				void* _t62;
				intOrPtr _t63;
				intOrPtr _t70;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t76;
				void* _t82;
				void* _t83;
				intOrPtr _t84;

				_t82 = _t83;
				_t84 = _t83 + 0xffffffec;
				_push(__esi);
				_push(__edi);
				_t62 = __eax;
				_t27 = GetCurrentThreadId();
				_t71 =  *0x506070; // 0x50703c
				if(_t27 !=  *_t71) {
					_v24 = GetCurrentThreadId();
					_v20 = 0;
					_t70 =  *0x505e58; // 0x40a78c
					E00411A98(_t62, _t70, 1, __edi, __esi, 0,  &_v24);
					E00404A74();
				}
				if(_t62 <= 0) {
					E0042A3B0();
				} else {
					E0042A3BC(_t62);
				}
				_v16 = 0;
				EnterCriticalSection(0x50be80);
				_push(_t82);
				_push(0x42a5de);
				_push( *[fs:eax]);
				 *[fs:eax] = _t84;
				_v16 = InterlockedExchange(0x503ec8, _v16);
				_push(_t82);
				_push(0x42a5bf);
				_push( *[fs:eax]);
				 *[fs:eax] = _t84;
				if(_v16 == 0 ||  *((intOrPtr*)(_v16 + 8)) <= 0) {
					_t34 = 0;
				} else {
					_t34 = 1;
				}
				_v5 = _t34;
				if(_v5 == 0 ||  *((intOrPtr*)(_v16 + 8)) <= 0) {
					_pop(_t72);
					 *[fs:eax] = _t72;
					_push(0x42a5c6);
					return E00404098(_v16);
				} else {
					_v12 = E00423584(_v16, 0);
					E00423478(_v16, 0);
					LeaveCriticalSection(0x50be80);
					_push(_t82);
					_push(0x42a561);
					_push( *[fs:eax]);
					 *[fs:eax] = _t84;
					_push(_t82);
					_push(0x42a522);
					_push( *[fs:eax]);
					 *[fs:eax] = _t84;
					_t63 =  *_v12;
					if( *((short*)(_t63 + 0xa)) == 0) {
						if( *((intOrPtr*)(_t63 + 0x10)) != 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x10)))) + 0xc))();
						}
					} else {
						 *((intOrPtr*)(_t63 + 8))();
					}
					_pop(_t75);
					 *[fs:eax] = _t75;
					_pop(_t76);
					 *[fs:eax] = _t76;
					_push(0x42a568);
					EnterCriticalSection(0x50be80);
					return 0;
				}
			}

0x0042a3fd
0x0042a3ff
0x0042a403
0x0042a404
0x0042a405
0x0042a407
0x0042a40c
0x0042a414
0x0042a41b
0x0042a41e
0x0042a428
0x0042a435
0x0042a43a
0x0042a43a
0x0042a441
0x0042a44c
0x0042a443
0x0042a445
0x0042a445
0x0042a453
0x0042a45b
0x0042a462
0x0042a463
0x0042a468
0x0042a46b
0x0042a47c
0x0042a481
0x0042a482
0x0042a487
0x0042a48a
0x0042a491
0x0042a49c
0x0042a4a0
0x0042a4a0
0x0042a4a0
0x0042a4a2
0x0042a4a9
0x0042a5ab
0x0042a5ae
0x0042a5b1
0x0042a5be
0x0042a4b4
0x0042a4be
0x0042a4c6
0x0042a4d0
0x0042a4d7
0x0042a4d8
0x0042a4dd
0x0042a4e0
0x0042a4e5
0x0042a4e6
0x0042a4eb
0x0042a4ee
0x0042a4f4
0x0042a4fb
0x0042a509
0x0042a515
0x0042a515
0x0042a4fd
0x0042a500
0x0042a500
0x0042a51a
0x0042a51d
0x0042a54b
0x0042a54e
0x0042a551
0x0042a55b
0x0042a560
0x0042a560

APIs

GetCurrentThreadId.KERNEL32 ref: 0042A407
GetCurrentThreadId.KERNEL32 ref: 0042A416

Part of subcall function 0042A3B0: ResetEvent.KERNEL32(00000224,0042A451), ref: 0042A3B6

EnterCriticalSection.KERNEL32(0050BE80), ref: 0042A45B
InterlockedExchange.KERNEL32(00503EC8,?,00000000,0042A5DE,?,0050BE80), ref: 0042A477
LeaveCriticalSection.KERNEL32(0050BE80,00000000,0042A5BF,?,00503EC8,?,00000000,0042A5DE,?,0050BE80), ref: 0042A4D0
EnterCriticalSection.KERNEL32(0050BE80,0042A568,0050BE80,00000000,0042A5BF,?,00503EC8,?,00000000,0042A5DE,?,0050BE80), ref: 0042A55B

Strings

<pP, xrefs: 0042A40C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CurrentEnterThread$EventExchangeInterlockedLeaveReset
String ID: <pP
API String ID: 2189153385-2523196900
Opcode ID: ed9010b4d19c7189f831e86743d986e0653ba90689a59f582b342278e881d3ee
Instruction ID: b07a64375a4a7c3659d59af2fe21e41274c3eba89ef09baa0d08fcb74cfda06e
Opcode Fuzzy Hash: ed9010b4d19c7189f831e86743d986e0653ba90689a59f582b342278e881d3ee
Instruction Fuzzy Hash: C641F130B04314AFD701EF65E846A6EB7B8EB49304FD184A6FC0097292D77C9D64CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 00401E90, Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00401B02), ref: 00401F26
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00401B02), ref: 00401F40

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c695cae7817ce182b96170587d5c636bfaeff629ba5e5af2bacd38abc6cd689f
Instruction ID: 9130983a600b5b0c11f6923a0e93f7fed2cbe7734fd1ed43da4bb86f7e20c7e9
Opcode Fuzzy Hash: c695cae7817ce182b96170587d5c636bfaeff629ba5e5af2bacd38abc6cd689f
Instruction Fuzzy Hash: AA7101716042408FD725CF29CD84B2ABBD4AB95314F1882BFE844AB3F2C7789845CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0046C354, Relevance: 12.2, APIs: 8, Instructions: 170windowCOMMON

Download Yara Rule

APIs

ImageList_DrawEx.COMCTL32(00000000,?,00000000,?,?,00000000,00000000,00000000,00000000,?), ref: 0046C3B3
ImageList_DrawEx.COMCTL32(00000000,?,00000000,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,?,?), ref: 0046C454
SetTextColor.GDI32(00000000,00FFFFFF,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,?,?), ref: 0046C4A1
SetBkColor.GDI32(00000000,00000000,00000000,00FFFFFF,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,000000FF,00000000,00000000), ref: 0046C4A9
BitBlt.GDI32(00000000,?,?,?,?,00000000,00000000,00000000,00E20746,00000000,00000000,00000000,00FFFFFF,?,?,00000000), ref: 0046C4CE

Part of subcall function 0046C32C: ImageList_GetBkColor.COMCTL32(00000000,?,0046C38D,00000000,?), ref: 0046C342

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ColorImageList_$Draw$Text
String ID:
API String ID: 2027629008-0
Opcode ID: 947a5906ff823d5e388b9d2fb81e10b254144f15dea48007395b2abbdbb4148d
Instruction ID: 17953005606b09866fe31d5bdb1880a01bb8d8a277bf2350115a78246109e272
Opcode Fuzzy Hash: 947a5906ff823d5e388b9d2fb81e10b254144f15dea48007395b2abbdbb4148d
Instruction Fuzzy Hash: 5851F971300204ABDB40FF69CD82F9F37ACAF08314F54116AB914EB296DA78ED418B69

Uniqueness

Uniqueness Score: -1.00%

Function 004B5954, Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004B5AD8,?,00000000,?), ref: 004B5A1A

Part of subcall function 004AF05C: FindClose.KERNEL32(000000FF,004AF151), ref: 004AF140

Strings

Stripped read-only attribute., xrefs: 004B59DC
Failed to strip read-only attribute., xrefs: 004B59E8
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 004B59F4
Failed to delete directory (%d)., xrefs: 004B5AB2
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 004B5A91
Failed to delete directory (%d). Will retry later., xrefs: 004B5A33
Deleting directory: %s, xrefs: 004B59A3

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 53911cbbb768d0350367c57b02ce66a6a96d7150b483617802a64ce2d08ac7d5
Instruction ID: e9126814c0c0fdcdc518d039e8178eaaf04db500706f210ebb128541f15cea4f
Opcode Fuzzy Hash: 53911cbbb768d0350367c57b02ce66a6a96d7150b483617802a64ce2d08ac7d5
Instruction Fuzzy Hash: 4041C430A046448BCB00EB6D88417EFF6E59F49714F55867FA441E7381DBBC9E05877A

Uniqueness

Uniqueness Score: -1.00%

Function 0047C0B4, Relevance: 12.1, APIs: 8, Instructions: 99windowthreadCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 0047C0DA
IsWindowUnicode.USER32(00000000), ref: 0047C11D
SendMessageW.USER32(00000000,-0000BBEE,00000000,000000EC,00000000), ref: 0047C138
SendMessageA.USER32(00000000,-0000BBEE,00000000,000000EC,00000000), ref: 0047C157
GetWindowThreadProcessId.USER32(00000000), ref: 0047C166
GetWindowThreadProcessId.USER32(?,?,00000000), ref: 0047C177
SendMessageW.USER32(00000000,-0000BBEE,00000000,000000EC,?,?,00000000), ref: 0047C197

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSendWindow$ProcessThread$CaptureUnicode
String ID:
API String ID: 1994056952-0
Opcode ID: 406cd44a5179dedf40f244f0404e3852d0dbd0e4ce4dc4f19226c0916f370c25
Instruction ID: b9a3b32fe4d14e3b1e6ea036c840c80843f547dbe73705e98d21b9f93a821c73
Opcode Fuzzy Hash: 406cd44a5179dedf40f244f0404e3852d0dbd0e4ce4dc4f19226c0916f370c25
Instruction Fuzzy Hash: 2F214C712046096FE660EA5ACD81BAB73DCEB54310B54843EF99DD3283D628EC008B68

Uniqueness

Uniqueness Score: -1.00%

Function 00432F2C, Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00432F5A
GetDeviceCaps.GDI32(?,00000068,00000000,00433029,?,00000000), ref: 00432F76
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?,?,00000068,00000000,00433029,?,00000000), ref: 00432F95
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0,?,00000000,00000008,?,?,00000068,00000000,00433029,?,00000000), ref: 00432FB9
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?,?,-00000008,00000001,00C0C0C0,?,00000000,00000008,?,?,00000068,00000000,00433029), ref: 00432FD7
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?,?,00000000,00000007,?,?,-00000008,00000001,00C0C0C0,?,00000000,00000008,?), ref: 00432FEB
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?,?,00000000,00000008,?,?,00000068,00000000,00433029,?,00000000), ref: 0043300B
ReleaseDC.USER32(00000000,?,00433030,00433029,?,00000000), ref: 00433023

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 844c87b0c4d8a73f1c7a981229f057e38b922d1da51c12131eb9f5c530ccbcb9
Instruction ID: 6d94a85d169a61ae6080e1d81012298c2eb12bfda96841d1097761818ffffce1
Opcode Fuzzy Hash: 844c87b0c4d8a73f1c7a981229f057e38b922d1da51c12131eb9f5c530ccbcb9
Instruction Fuzzy Hash: 4F2174B1A00248AADB10DFA9CD81FAE73BCEB4C704F5004A6B704F71D1D6799F419B28

Uniqueness

Uniqueness Score: -1.00%

Function 00402088, Relevance: 10.9, APIs: 7, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0fa277608e4e11bd80e37437e1f5276dbe4e762b4cea392dec81c95e41b147
Instruction ID: f577d5922b35ffb72e6af8373982112926fd0b401be06e6ffb4a34e46ea0086f
Opcode Fuzzy Hash: 5d0fa277608e4e11bd80e37437e1f5276dbe4e762b4cea392dec81c95e41b147
Instruction Fuzzy Hash: 20C126727006000BD7159ABD9D8976EB3869BC4325F18827FF604EB3E6DABCDC458798

Uniqueness

Uniqueness Score: -1.00%

Function 004029CC, Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 277windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,00401548,00002010), ref: 00402DA1

Strings

n0P, xrefs: 00402B4E
7, xrefs: 00402B44
,zP, xrefs: 00402AAB
,zP, xrefs: 00402A1E
, xrefs: 00402CDA

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Message
String ID: $,zP$,zP$7$n0P
API String ID: 2030045667-2129108997
Opcode ID: 701b4473c9b69f62dc079a9e826541c03aa13e0297c62765f45756fd4fd0a4db
Instruction ID: e1ce7b96fd5494123f0230ccbe08845ebc3c730a9d87643d2fa317476636ec1b
Opcode Fuzzy Hash: 701b4473c9b69f62dc079a9e826541c03aa13e0297c62765f45756fd4fd0a4db
Instruction Fuzzy Hash: 88B1A330B042548BDB21EB2DCD88B9D77E4AB19304F1441F6E449E73D2DBB89D85CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0044DE94, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 217windowCOMMON

Download Yara Rule

APIs

InsertMenuItemW.USER32(?,000000FF,000000FF,00000030,00000000,0044E15C), ref: 0044E0AA

Part of subcall function 0044E420: CreateMenu.USER32(?,0044E323,?,?,00000000,?,0044E2AB,?,004535DD,00476538), ref: 0044E44B

GetVersion.KERNEL32(00000000,0044E15C), ref: 0044DF31

Part of subcall function 0044E420: CreatePopupMenu.USER32(?,0044E323,?,?,00000000,?,0044E2AB,?,004535DD,00476538), ref: 0044E43E

InsertMenuW.USER32(?,000000FF,00000000,00000000,00000000,00000000,0044E15C), ref: 0044E11D
InsertMenuW.USER32(?,000000FF,00000000,?,00000000,00000000,0044E15C), ref: 0044E139

Strings

,, xrefs: 0044DF5B
?, xrefs: 0044DF62

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 53c9bfb4e36bfe0099c32cd5a6f347428dff6adfd3e0cf165485fd64a8d96ea7
Instruction ID: c9c5a0051f30258598eab424c753cdf76316ddc28bf9d97479ba6316916e652e
Opcode Fuzzy Hash: 53c9bfb4e36bfe0099c32cd5a6f347428dff6adfd3e0cf165485fd64a8d96ea7
Instruction Fuzzy Hash: E881D170A00245AFEB20EFAAD9816AEB7F1BB05314F54402BF55193792D338ED29DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004AE954, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 216COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,004AEB86,?,00000000,004AEBE8,?,?,00000000,004AEC82,?,?,00000000), ref: 004AEA3A

Strings

MoveFileEx, xrefs: 004AEC50
[rename], xrefs: 004AEA9E, 004AEADA
WININIT.INI, xrefs: 004AE9E8
.tmp, xrefs: 004AE9F6
NUL, xrefs: 004AEAFD

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: a150b56f6ea985e814b9ab3c2bca7eae17bcee7d4009e4d85e32bedcac1b5924
Instruction ID: 07aed7ddc863e0676a7048ae61a9060333a519a0db93554e2bd70e99d8f5eb15
Opcode Fuzzy Hash: a150b56f6ea985e814b9ab3c2bca7eae17bcee7d4009e4d85e32bedcac1b5924
Instruction Fuzzy Hash: 92813270A002099FDF10EB96C882BDEB7B5EF5A304F50846AF911B7391D779AD05CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004A1AC8, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 193libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,?,00000000,004A1D39,?,?,?,?,00000000,00000000), ref: 004A1C4F
LoadLibraryW.KERNEL32(00000000,?,?,?,00000000,004A1D39,?,?,?,?,00000000,00000000), ref: 004A1C61
GetLastError.KERNEL32(00000000,?,?,?,00000000,004A1D39,?,?,?,?,00000000,00000000), ref: 004A1C76
GetProcAddress.KERNEL32(00000000,00000000,?,?,00000000,004A1D39,?,?,?,?,00000000,00000000), ref: 004A1CDE
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,004A1D39,?,?,?,?,00000000,00000000), ref: 004A1CF9

Strings

<utf8>, xrefs: 004A1C02

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLibraryLoad$AddressProc
String ID: <utf8>
API String ID: 2044736156-2377197763
Opcode ID: 1e7828682d364f0bc47a18bfb6fa7135b6801dbda29468ced18ac66a53893831
Instruction ID: 7b0bebdcf38df4aa346a4cf993444a4e029de9522837f53349d1d9c6dd534d7a
Opcode Fuzzy Hash: 1e7828682d364f0bc47a18bfb6fa7135b6801dbda29468ced18ac66a53893831
Instruction Fuzzy Hash: 14714E74A002099FDB00EFA5C481A9EB7F5EF55314F50817AE404BB3A6D778AE45CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0047C900, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 138windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0047DDB0: GetActiveWindow.USER32(00000000,00000000,0047C91C,?,00000000,00000000), ref: 0047DDD7
Part of subcall function 0047DDB0: GetLastActivePopup.USER32(00000000,00000000,00000000,0047C91C,?,00000000,00000000), ref: 0047DDEC

GetWindowRect.USER32(00000000,?), ref: 0047C98B
SetWindowPos.USER32(00000000,00000000,?,?,00000000,00000000,0000001D,00000000,?), ref: 0047C9C6
MessageBoxW.USER32(00000000,00000000,00000000,00000000,00000000,0047CA77), ref: 0047CA05
SetWindowPos.USER32(00000000,00000000,?,?,00000000,00000000,0000001D,0047CA7E,00000000,00000000,0047CA77), ref: 0047CA58
SetActiveWindow.USER32(00000000,0047CA7E,00000000,00000000,0047CA77), ref: 0047CA69

Strings

(, xrefs: 0047C965

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Active$LastMessagePopupRect
String ID: (
API String ID: 3456420849-3887548279
Opcode ID: 4f2d2cae722839273d43b5d94fdf20841683292b690dc48680cc6460267df445
Instruction ID: 89987a75ad37d50be8a3438e5149aa6a7cc055e18b2f43798090d99ef2f030e8
Opcode Fuzzy Hash: 4f2d2cae722839273d43b5d94fdf20841683292b690dc48680cc6460267df445
Instruction Fuzzy Hash: 7751E9B5A00208AFDB44DBA8C985FEEB7F5FB48304F54846AF508EB391D674AD018B54

Uniqueness

Uniqueness Score: -1.00%

Function 004A72D0, Relevance: 10.6, APIs: 7, Instructions: 110COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000014), ref: 004A7313
SetTextColor.GDI32(00000000,00000000,00000014), ref: 004A732B
DrawTextW.USER32(00000000,00000000,?,?,?,00000000,00000000,00000014), ref: 004A7361
GetSysColor.USER32(00000010,00000000,00000000,?,?,?,00000000,00000000,00000014), ref: 004A7375
SetTextColor.GDI32(00000000,00000000,00000010,00000000,00000000,?,?,?,00000000,00000000,00000014), ref: 004A738D
DrawTextW.USER32(?,00000000,?,?,?,00000000,00000000,00000010,00000000,00000000,?,?,?,00000000,00000000,00000014), ref: 004A73C3
DrawTextW.USER32(?,00000000,?,?,?), ref: 004A73FB

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Text$Color$Draw
String ID:
API String ID: 2775849416-0
Opcode ID: 16ad6c856f7c3356d58ec8bcf8e88c4c21f4391a2ff52a03ad7cf78e5e7285a2
Instruction ID: fa7f8734ce063193e67c96ca50459853a42bbfb3e77c7678f43063fec852bf19
Opcode Fuzzy Hash: 16ad6c856f7c3356d58ec8bcf8e88c4c21f4391a2ff52a03ad7cf78e5e7285a2
Instruction Fuzzy Hash: 12311475701104AFD740EB6DCD89D9AB7E8AF48314F15817AF918DB3A2C674EE008B58

Uniqueness

Uniqueness Score: -1.00%

Function 004B2408, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,?,?,?,00000000,004B2571), ref: 004B2459

Part of subcall function 0047BF3C: GetWindowTextW.USER32(?,?,00000100,00000000,00000001,004815F2,00000000,00400000,00000000,61736944,00000000,00000000,00000000,00000000,80000000,00000000), ref: 0047BF6B

Part of subcall function 00470C94: GetCurrentThreadId.KERNEL32(00470C44,00000000,00000000,00470D08,?,00000000,00470D46,?,00480FE0,000000EC,00000001), ref: 00470CEB
Part of subcall function 00470C94: EnumThreadWindows.USER32(00000000,00470C44,00000000,00000000,00470D08,?,00000000,00470D46,?,00480FE0,000000EC,00000001), ref: 00470CF1

Part of subcall function 0047BFC0: SetWindowTextW.USER32(?,00000000,00000000,?,004FF846,00000000,004FFACA,?,?,00000000,?), ref: 0047BFF0

GetMessageW.USER32(?,00000000,00000000,00000000,00000000,004B251F,?,00000000,?,?,?,00000000,004B2571), ref: 004B24BC
TranslateMessage.USER32(?,?,00000000,00000000,00000000,00000000,004B251F,?,00000000,?,?,?,00000000,004B2571), ref: 004B24DA
DispatchMessageW.USER32(?,?,?,00000000,00000000,00000000,00000000,004B251F,?,00000000,?,?,?,00000000,004B2571), ref: 004B24E3

Strings

[Paused] , xrefs: 004B2497

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
String ID: [Paused]
API String ID: 1007367021-4230553315
Opcode ID: 4ab8dd82815be4a81e0c380c41ac0bd3037ae83cb9a5485150258abdfd967397
Instruction ID: b8b41b4a840e2c2939df1c2ef93b01dab69a9d5d5c5e9c013d2defe17b40ba61
Opcode Fuzzy Hash: 4ab8dd82815be4a81e0c380c41ac0bd3037ae83cb9a5485150258abdfd967397
Instruction Fuzzy Hash: 9131A330904248AEDB11DB79D951BDDBBF8EB09300F5184A7F808E3291D6B89D04DB39

Uniqueness

Uniqueness Score: -1.00%

Function 00452778, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

GetKeyboardLayoutNameW.USER32(00000000,00000000,004528B1), ref: 004527A2

Part of subcall function 0042E8F4: RegCloseKey.ADVAPI32(10AC0000,0042E770,00000001,0042E872,?,?,004374A6,00000008,00000060,00000048,00000000,00437546), ref: 0042E908

Part of subcall function 0042E958: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,0042EB09), ref: 0042E9D1

Part of subcall function 00413CA8: SetErrorMode.KERNEL32(00008000,?), ref: 00413CB2
Part of subcall function 00413CA8: LoadLibraryW.KERNEL32(00000000,00000000,00413CFC,?,00000000,00413D1A,?,00008000,?), ref: 00413CE1

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

FreeLibrary.KERNEL32(?,00452871,?,00000000,00000000,004528B1), ref: 00452864

Strings

Layout File, xrefs: 00452803
KbdLayerDescriptor, xrefs: 0045282E
pB, xrefs: 004527A9
\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\, xrefs: 004527E7

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressCloseErrorFreeKeyboardLayoutLoadModeNameOpenProc
String ID: KbdLayerDescriptor$Layout File$\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\$pB
API String ID: 3365787578-2731565551
Opcode ID: 00c9046a22598ab0c8d632b5bb46f2ce7aedd36fe08eca4caea04a99891be6a0
Instruction ID: 231ef142908acabba71ed419fc92e19132e034ba3152c699528eed1563dd281c
Opcode Fuzzy Hash: 00c9046a22598ab0c8d632b5bb46f2ce7aedd36fe08eca4caea04a99891be6a0
Instruction Fuzzy Hash: DF31BF70A00208AFDB01EFA2C9519DDBBF5FB89304B60847BE800B7691D77DAD44CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0046D0D8, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 004125AC: GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,00412682), ref: 004125EE
Part of subcall function 004125AC: GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,00412665,?,00000000,?,00000000,00412682), ref: 00412623
Part of subcall function 004125AC: VerQueryValueW.VERSION(?,00412694,?,?,00000000,?,00000000,?,00000000,00412665,?,00000000,?,00000000,00412682), ref: 0041263D

GetModuleHandleW.KERNEL32(comctl32.dll), ref: 0046D10C

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

ImageList_Write.COMCTL32(00000000,?,00000000,0046D1D2), ref: 0046D19C

Strings

comctl32.dll, xrefs: 0046D0EC
LB, xrefs: 0046D170, 0046D1A5
ImageList_WriteEx, xrefs: 0046D117
comctl32.dll, xrefs: 0046D107

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoVersion$AddressHandleImageList_ModuleProcQuerySizeValueWrite
String ID: ImageList_WriteEx$LB$comctl32.dll$comctl32.dll
API String ID: 4063495462-988291208
Opcode ID: 98996e5909760e7d168e2e48f02ec3a3197e01ac41c2c5c51f6cfb2a3468a101
Instruction ID: c5f457c971c6cdee205a02ee4d6d80ccf0a01dc99eb3633964bdba5a75e415f2
Opcode Fuzzy Hash: 98996e5909760e7d168e2e48f02ec3a3197e01ac41c2c5c51f6cfb2a3468a101
Instruction Fuzzy Hash: 01218E70F00200AAD710AF369D55AAB36A9AB57708B40023BF401D76A2EBBD9C45DA1E

Uniqueness

Uniqueness Score: -1.00%

Function 004DA2E4, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 72fileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetFinalPathNameByHandleW), ref: 004DA310
GetFileAttributesW.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 004DA329
CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 004DA353
CloseHandle.KERNEL32(00000000), ref: 004DA371

Strings

kernel32.dll, xrefs: 004DA30B
GetFinalPathNameByHandleW, xrefs: 004DA306

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandle$AttributesCloseCreateModule
String ID: GetFinalPathNameByHandleW$kernel32.dll
API String ID: 791737717-340263132
Opcode ID: bfb154168851d29a5e83c98089f5c45a2adfd0bbfb63e69206ddf916eef808d6
Instruction ID: 546dd309093d948ebbf6c5de248d67134483e74d87d8ea917b531757c0d4b539
Opcode Fuzzy Hash: bfb154168851d29a5e83c98089f5c45a2adfd0bbfb63e69206ddf916eef808d6
Instruction Fuzzy Hash: 0D11C86174070437E620357A4C97F2B218D8B4176CF140637BE15E63D3E9BD9C21425F

Uniqueness

Uniqueness Score: -1.00%

Function 0042DDBC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0042DE14
GetSystemMetrics.USER32(00000000,00000030,00000000,?,00000000), ref: 0042DE29
GetSystemMetrics.USER32(00000001), ref: 0042DE34
lstrcpyW.KERNEL32(?,DISPLAY), ref: 0042DE5E

Part of subcall function 0042DA04: GetProcAddress.KERNEL32(77400000,00000000,00000000,0042DAE6), ref: 0042DAA0

Strings

DISPLAY, xrefs: 0042DE55
GetMonitorInfoW, xrefs: 0042DDD4

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: System$Metrics$AddressInfoParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoW
API String ID: 2545840971-2774842281
Opcode ID: 2d7dae5732bf9c2438a3e59fc8adc3f830839cdc84f43cfbbfe68bb6d1a8c62e
Instruction ID: c1a1393f400a87f276651e3f47c4416e5d0270dc2c65a745b83f1128538ac5c8
Opcode Fuzzy Hash: 2d7dae5732bf9c2438a3e59fc8adc3f830839cdc84f43cfbbfe68bb6d1a8c62e
Instruction Fuzzy Hash: 8011DA31B00B149FE720DF65EC84BA777A9FB15710F41452EEA459B241D3B5A804C795

Uniqueness

Uniqueness Score: -1.00%

Function 0042DEAC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0042DF04
GetSystemMetrics.USER32(00000000,00000030,00000000,?,00000000), ref: 0042DF19
GetSystemMetrics.USER32(00000001), ref: 0042DF24
lstrcpyW.KERNEL32(?,DISPLAY), ref: 0042DF4E

Part of subcall function 0042DA04: GetProcAddress.KERNEL32(77400000,00000000,00000000,0042DAE6), ref: 0042DAA0

Strings

GetMonitorInfoA, xrefs: 0042DEC4
DISPLAY, xrefs: 0042DF45

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: System$Metrics$AddressInfoParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoA
API String ID: 2545840971-1370492664
Opcode ID: 4f4d2c3505a3035e86c64bda316503c6b74be6da49ec91d4e6a8e70394dac768
Instruction ID: e612018f26e3eeab97efd3aafcba48210d63bdbb4462d0d6d76787917b1b8400
Opcode Fuzzy Hash: 4f4d2c3505a3035e86c64bda316503c6b74be6da49ec91d4e6a8e70394dac768
Instruction Fuzzy Hash: 2211A231B017249EE7209F64ED84BABB7F9EB15750F41452AEA4A97380D3B4A808C79D

Uniqueness

Uniqueness Score: -1.00%

Function 0042DF9C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0042DFF4
GetSystemMetrics.USER32(00000000,00000030,00000000,?,00000000), ref: 0042E009
GetSystemMetrics.USER32(00000001), ref: 0042E014
lstrcpyW.KERNEL32(?,DISPLAY), ref: 0042E03E

Part of subcall function 0042DA04: GetProcAddress.KERNEL32(77400000,00000000,00000000,0042DAE6), ref: 0042DAA0

Strings

DISPLAY, xrefs: 0042E035
GetMonitorInfoW, xrefs: 0042DFB4

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: System$Metrics$AddressInfoParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoW
API String ID: 2545840971-2774842281
Opcode ID: 67de54c9aa73b95b32fa261fa4f46ea3f206db974cfe2dcdb1879c822f83a8e0
Instruction ID: 03b30a4923bc5d0dade8ae9a2eeaa62d417febe35bf0423ff4b6963b9763b08e
Opcode Fuzzy Hash: 67de54c9aa73b95b32fa261fa4f46ea3f206db974cfe2dcdb1879c822f83a8e0
Instruction Fuzzy Hash: 061106327003249FE760CF21ED84BABB7A9FB05310F44042EE905D7281D7F8A845C799

Uniqueness

Uniqueness Score: -1.00%

Function 004343D8, Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00433180: GetObjectW.GDI32(00000000,00000004,?,000000FF,00000000,00000018,00000000,004346E2,00000000,00434838,?,00000000,00434B2E,?,00000000,00000000), ref: 00433197
Part of subcall function 00433180: GetPaletteEntries.GDI32(00000000,00000000,?,00000028,00000000,00000004,?,000000FF,00000000,00000018,00000000,004346E2,00000000,00434838,?,00000000), ref: 004331BA

GetDC.USER32(00000000), ref: 00434416
CreateCompatibleDC.GDI32(?,00000000), ref: 00434422
SelectObject.GDI32(?,?,?,00000000), ref: 0043442F
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,00434487,?,?,?,?,00000000), ref: 00434453
SelectObject.GDI32(?,?,0043448E,?,00000000,00434487,?,?,?,?,00000000), ref: 0043446D
DeleteDC.GDI32(?,?,?,0043448E,?,00000000,00434487,?,?,?,?,00000000), ref: 00434476
ReleaseDC.USER32(00000000,?,?,?,?,0043448E,?,00000000,00434487,?,?,?,?,00000000), ref: 00434481

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: 8de3fb205990a5cd4a90833d643090370ea9ebbeedb804118f41b271a2d36ea7
Instruction ID: bee6ac960231a00efcb8930e40721e72f2754d404828f8f8889af595ab63ad51
Opcode Fuzzy Hash: 8de3fb205990a5cd4a90833d643090370ea9ebbeedb804118f41b271a2d36ea7
Instruction Fuzzy Hash: EA1163B1E002586FDB10EBE9CC51AAEB3FCEB4C714F1044BAF504E7692D6799E408B58

Uniqueness

Uniqueness Score: -1.00%

Function 0042AC04, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66threadsynchronizationwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0042AC2F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0042AC5B
MsgWaitForMultipleObjects.USER32(00000002,?,00000000,000003E8,00000040), ref: 0042AC70
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0042AC9D
GetExitCodeThread.KERNEL32(?,?,?,000000FF), ref: 0042ACA8

Strings

<pP, xrefs: 0042AC34

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ThreadWait$CodeCurrentExitMessageMultipleObjectObjectsPeekSingle
String ID: <pP
API String ID: 1797888035-2523196900
Opcode ID: 3ffdf4f6a9907350870522e499c5982bc0bf76d130752befb7b50dc2ced1e995
Instruction ID: b3540d7a75c716d9fee4ee0790b6e0aa76304ed94c788448d45b7e010c8b6fe5
Opcode Fuzzy Hash: 3ffdf4f6a9907350870522e499c5982bc0bf76d130752befb7b50dc2ced1e995
Instruction Fuzzy Hash: 6A1100707003206BD610FB76DCC2B5E73989B44714F904A2AFA40EB2D2D678EC51874F

Uniqueness

Uniqueness Score: -1.00%

Function 00479D40, Relevance: 10.6, APIs: 7, Instructions: 58threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00479D5B
WindowFromPoint.USER32(?,?), ref: 00479D68
GetWindowThreadProcessId.USER32(00000000,00000000,?,?), ref: 00479D76
GetCurrentThreadId.KERNEL32(00000000,00000000,?,?), ref: 00479D7D
SendMessageW.USER32(00000000,00000084,00000000,00000000,00000000,00000000,?,?), ref: 00479DA0
SendMessageW.USER32(00000000,00000020,00000000,?,00000000,00000084,00000000,00000000,00000000,00000000,?,?), ref: 00479DB2
SetCursor.USER32(00000000), ref: 00479DC4

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: f66f888cb535ebd07a920a9f19c63f83064f22127bf1abcfdb2b9625641429a2
Instruction ID: 459144e2101ff5889cf4cfba8cf449991f37702ca61c9788b79c8661eb1db498
Opcode Fuzzy Hash: f66f888cb535ebd07a920a9f19c63f83064f22127bf1abcfdb2b9625641429a2
Instruction Fuzzy Hash: 7401B93610420165EA3176668D46FBB3659DFC1B54F10893BB648AA1C3EA3DCC01527D

Uniqueness

Uniqueness Score: -1.00%

Function 004FC7F4, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000,?,?,00000000), ref: 004FC805
SelectObject.GDI32(00000000,00000000,00000000,004FC880,?,00000000,?,?,00000000), ref: 004FC827
GetTextExtentPointW.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,004FCE03,00000000,00000000,00000000,004FC880,?,00000000,?,?,00000000), ref: 004FC83B
GetTextMetricsW.GDI32(00000000,?,00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,004FCE03,00000000,00000000,00000000,004FC880,?,00000000,?,?,00000000), ref: 004FC85D
ReleaseDC.USER32(00000000,00000000,004FC887,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,004FCE03,00000000,00000000,00000000,004FC880,?,00000000,?,?,00000000), ref: 004FC87A

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 004FC832

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Text$ExtentMetricsObjectPointReleaseSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 844173074-222967699
Opcode ID: 1384388e26469f47dcc7fe4c5b72f043a4cc9e1ed781c480530cce3b188bfd60
Instruction ID: 26e4b5ac5a18cf718ca1a199ca44c34f5ed119426ad2a87294ab56fc19fd22ad
Opcode Fuzzy Hash: 1384388e26469f47dcc7fe4c5b72f043a4cc9e1ed781c480530cce3b188bfd60
Instruction Fuzzy Hash: D3016176B04248AFDB04EAE98D41E6EB7ECDB4C715F11047AF600E72D2D678AD008B68

Uniqueness

Uniqueness Score: -1.00%

Function 004450F8, Relevance: 9.3, APIs: 6, Instructions: 312windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00445163
GetTickCount.KERNEL32 ref: 0044518B
SendMessageW.USER32(00000000,0000014E,000000FF,00000000,?), ref: 00445289
SendMessageW.USER32(00000000,00000142,00000000,?,?,00000000,0000014E,000000FF,00000000,?), ref: 004452DA

Part of subcall function 00445054: SendMessageW.USER32(00000000,0000014E,000000FF,00000000,00000000,004450EB,?,?,?,00000000), ref: 0044509F
Part of subcall function 00445054: SendMessageW.USER32(00000000,00000142,00000000,?,00000000,0000014E,000000FF,00000000,00000000,004450EB,?,?,?,00000000), ref: 004450D0

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00445435
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001,?,00000000,00000000,00000000,00000000), ref: 00445483

Part of subcall function 00443D80: SendMessageW.USER32(00000000,00000157,00000000,00000000,?,004442DA,00000000,00444415), ref: 00443D94

Part of subcall function 00443DA4: SendMessageW.USER32(00000000,0000014F,?,00000000), ref: 00443DC0
Part of subcall function 00443DA4: InvalidateRect.USER32(00000000,000000FF,000000FF), ref: 00443DDD

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Send$CountPeekTick$InvalidateRect
String ID:
API String ID: 2065907832-0
Opcode ID: 2e59ff5adad4a7d7fac36c8002b860b956116045a8cafd541366ac88bb21c1af
Instruction ID: 7cbdab1808ce903890bd25f78d51380d9c3f4a04594898288e36967ff315b37d
Opcode Fuzzy Hash: 2e59ff5adad4a7d7fac36c8002b860b956116045a8cafd541366ac88bb21c1af
Instruction Fuzzy Hash: B7C15330A00509ABEF10EBA5C985BDEB3B5EF44304F2440A7F401BB396D778AE45DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00465670, Relevance: 9.2, APIs: 6, Instructions: 224COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,000000FF,?,?,?,?,00000010,00000000,0046590D), ref: 00465805
GetTickCount.KERNEL32(00000000,000000FF,?,?,?,?,00000010,00000000,0046590D), ref: 0046580A
SystemParametersInfoW.USER32(00001016,00000000,?,00000000,00000000,000000FF,?,?,?,?,00000010,00000000,0046590D), ref: 00465869
SystemParametersInfoW.USER32(00001018,00000000,00000000,00000000,00001016,00000000,?,00000000,00000000,000000FF,?,?,?,?,00000010,00000000), ref: 00465881
ShowWindow.USER32(00000000,00000004,00000000,000000FF,?,?,?,?,00000010,00000000,0046590D), ref: 004658D7
GetTickCount.KERNEL32(00465914), ref: 004658F4

Part of subcall function 0046905C: GetCursorPos.USER32(?,00000000,0046589D,00001018,00000000,00000000,00000000,00001016,00000000,?,00000000,00000000,000000FF,?,?,?), ref: 00469060

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CountInfoParametersSystemTickWindow$CursorShow
String ID:
API String ID: 2349304477-0
Opcode ID: 8c62d9b8865c1a1a05456f8f125d5577a60596f95ec55d1a0f890ad1a9f78da7
Instruction ID: 907b1dcbad31f19c75d53b82a55a1969eb32d57ed11b899cd72e16a438d42abe
Opcode Fuzzy Hash: 8c62d9b8865c1a1a05456f8f125d5577a60596f95ec55d1a0f890ad1a9f78da7
Instruction Fuzzy Hash: DF814B75A006049FDB10EF69C881A9EB7F5AF48308F10847AF845EB392E679ED45CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00473DC4, Relevance: 9.2, APIs: 6, Instructions: 151COMMON

Download Yara Rule

APIs

FillRect.USER32(?,?), ref: 00473E43
GetClientRect.USER32(00000000,?), ref: 00473E6E
FillRect.USER32(?,?,00000000,00000000,?), ref: 00473E8A

Part of subcall function 00473D38: CallWindowProcW.USER32(?,?,?,?,?), ref: 00473D72

BeginPaint.USER32(?,?), ref: 00473F02
GetWindowRect.USER32(?,?,00000000,00473F95), ref: 00473F2F
EndPaint.USER32(?,?,00473FA3), ref: 00473F8F

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$FillPaintWindow$BeginCallClientProc
String ID:
API String ID: 901200654-0
Opcode ID: 2be5c66139b4506e704a77f86dda8cbe303b861a0780450b5159b3c33071ed49
Instruction ID: 427ae9f54cf5de20393d170c263418cf9789b19c8dc5243d0f3292ab74b3130a
Opcode Fuzzy Hash: 2be5c66139b4506e704a77f86dda8cbe303b861a0780450b5159b3c33071ed49
Instruction Fuzzy Hash: F351E774E04108EFCB10DFA9C589ADDB7F8AF09315F1581AAE418EB352D739AE45DB08

Uniqueness

Uniqueness Score: -1.00%

Function 00476624, Relevance: 9.1, APIs: 6, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00432024: EnterCriticalSection.KERNEL32(0050BF20,00000000,0043416D,00000000,?,?,00435AF6,00436584,00000000,?,?), ref: 0043202C
Part of subcall function 00432024: LeaveCriticalSection.KERNEL32(0050BF20,0050BF20,00000000,0043416D,00000000,?,?,00435AF6,00436584,00000000,?,?), ref: 00432039
Part of subcall function 00432024: EnterCriticalSection.KERNEL32(?,0050BF20,0050BF20,00000000,0043416D,00000000,?,?,00435AF6,00436584,00000000,?,?), ref: 00432042

SaveDC.GDI32(?,00000000,004767ED,?,00000000,00476810), ref: 00476671
ExcludeClipRect.GDI32(?,?,?,?,?), ref: 004766EC
GetStockObject.GDI32(00000004), ref: 0047670B
FillRect.USER32(00000000,?,00000000,00000004), ref: 00476724
RestoreDC.GDI32(?,?,004767A7), ref: 0047679A

Part of subcall function 00430758: GetSysColor.USER32(?,00431848,00000000,00431872), ref: 00430762

SetBkColor.GDI32(00000000,00000000), ref: 0047676F

Part of subcall function 00431F24: FillRect.USER32(?,?,00000000,?,?), ref: 00431F4D

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalRectSection$ColorEnterFill$ClipExcludeLeaveObjectRestoreSaveStock
String ID:
API String ID: 3001281481-0
Opcode ID: 66459a1b6042e2dc7390ed58636b8805b89a83774789bb7378c3aeffc5364aed
Instruction ID: 20dde089aad4802a1510a90e7b8e65b2adf5da33d0b0673bc5dde7b9f6d780ce
Opcode Fuzzy Hash: 66459a1b6042e2dc7390ed58636b8805b89a83774789bb7378c3aeffc5364aed
Instruction Fuzzy Hash: DD41FB74A00648EFDB45DFA9C989EDAB7F9AF08304F5644A5F408E7352C778AE00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0047BDA4, Relevance: 9.1, APIs: 6, Instructions: 98windowCOMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,?,0047B736,00000000,0047BC66), ref: 0047BDC6
ShowWindow.USER32(00000000,00000009,?,?,?,0047B736,00000000,0047BC66), ref: 0047BDE9
IsWindowEnabled.USER32(00000000,?,?,?,0047B736,00000000,0047BC66), ref: 0047BE0B
DefWindowProcW.USER32(?,00000112,0000F120,00000000,00000000,?,?,?,0047B736,00000000,0047BC66), ref: 0047BE27
SetWindowPos.USER32(?,00000000,00000000,?,?,0047B736,00000000,0047BC66), ref: 0047BE73
SetFocus.USER32(00000000,?,?,?,0047B736,00000000,0047BC66), ref: 0047BEC1

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$ActiveEnabledFocusProcShow
String ID:
API String ID: 2052594614-0
Opcode ID: adcb3ee97f1ec79d2be4b095e6161527bd84d33a74a6e62a65b8f440fb872eb6
Instruction ID: 845e55801361603a3031db8fffb82a745ff2a321eed68dcac185151e89cf7aa4
Opcode Fuzzy Hash: adcb3ee97f1ec79d2be4b095e6161527bd84d33a74a6e62a65b8f440fb872eb6
Instruction Fuzzy Hash: B8311C71600640DBEB21AA65CC8ABDA3794AB14704F0884BAFE089F3D7D77DEC448799

Uniqueness

Uniqueness Score: -1.00%

Function 00433430, Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0043347E
GetSystemMetrics.USER32(0000000C,0000000B), ref: 0043348A
GetDC.USER32(00000000), ref: 004334A6
GetDeviceCaps.GDI32(00000000,0000000E,00000000,00433519,?,00000000), ref: 004334CD
GetDeviceCaps.GDI32(00000000,0000000C,00000000,0000000E,00000000,00433519,?,00000000), ref: 004334DA
ReleaseDC.USER32(00000000,00000000,00433520,0000000E,00000000,00433519,?,00000000), ref: 00433513

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 5804b78d3489b697980edfdab9ce67ac132c937dd39c7ec90e622826a0b859a2
Instruction ID: 497093f791e014c29f493765d82b0156aa72ead38a26f76001c406fac6643bd1
Opcode Fuzzy Hash: 5804b78d3489b697980edfdab9ce67ac132c937dd39c7ec90e622826a0b859a2
Instruction Fuzzy Hash: 74318474A00204EFDB00DFA5C881AAEBBB5FF4C314F10856AF814AB391C7389E41CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004B9264, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,004B932F,?,?,?,00000000), ref: 004B92CE
SetLastError.KERNEL32(00000000,00000002,?,?,?,004B93D0,?,00000000,004B932F,?,?,?,00000000), ref: 004B930D

Strings

CLASSES_ROOT, xrefs: 004B9293
USERS, xrefs: 004B92C0
CURRENT_USER, xrefs: 004B92A2
MACHINE, xrefs: 004B92B1

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: c2be04c82d1ddc59c670ad234b9cb2a99c45d52b71df7fca3a4d5b5065969a4b
Instruction ID: a9551f56feb79466836deb78d8ebb3c8c72a128de9afa45091a34bfcc7697f43
Opcode Fuzzy Hash: c2be04c82d1ddc59c670ad234b9cb2a99c45d52b71df7fca3a4d5b5065969a4b
Instruction Fuzzy Hash: 7311E735604208FFDB04DE948882BE973E8DB48300F7584BB6F01A26C1D27C5E01A13D

Uniqueness

Uniqueness Score: -1.00%

Function 004E1C6C, Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC,?,004FE779,00000000,004FF080), ref: 004E1C88
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,004FE779,00000000,004FF080), ref: 004E1CB7
GetWindowLongW.USER32(?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,004FE779,00000000,004FF080), ref: 004E1CCC
SetWindowLongW.USER32(?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,004FE779), ref: 004E1CF2
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 004E1D0B
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 004E1D2C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: ade1825080079cc36f09e30e7209bbfb732fef5b59536a5344699f05abd15580
Instruction ID: 95da70da3afc4ff558423a8d132f4b758891e19e2bddb8623f4a3ad4edf778c7
Opcode Fuzzy Hash: ade1825080079cc36f09e30e7209bbfb732fef5b59536a5344699f05abd15580
Instruction Fuzzy Hash: 70112E35244B00DFD700DB69CC85F6A33A87B1D311F1801A6FA48DB3F2C279AC09AB15

Uniqueness

Uniqueness Score: -1.00%

Function 00433890, Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0043373C: GetObjectW.GDI32(?,00000054), ref: 00433750

CreateCompatibleDC.GDI32(00000000), ref: 004338B2
SelectPalette.GDI32(?,?,00000000,00000000,0043392D,?,00000000), ref: 004338D3
RealizePalette.GDI32(?,?,?,00000000,00000000,0043392D,?,00000000), ref: 004338DF
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000,00000000,0043392D,?,00000000), ref: 004338F6
SelectPalette.GDI32(?,00000000,00000000,00433934,00000000,?,?,?,00000000,00000000,0043392D,?,00000000), ref: 0043391E
DeleteDC.GDI32(?,00433934,00000000,?,?,?,00000000,00000000,0043392D,?,00000000), ref: 00433927

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: 93bea2a807db466eaafcd85b9d84d68b1bb5b8286eba14d2ca91080702f8a34b
Instruction ID: f348476d1449874f5626ef0c033da47246950ee2e3768fb1adb14d5e3f8e6a10
Opcode Fuzzy Hash: 93bea2a807db466eaafcd85b9d84d68b1bb5b8286eba14d2ca91080702f8a34b
Instruction Fuzzy Hash: 90110DB5B04244BBDB10DAA9CC81F5EB7FCEF4C714F51846AB514E7382D6789E008B68

Uniqueness

Uniqueness Score: -1.00%

Function 004330DC, Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000,00000000,?,?,00435D27,?,?,?,?,00434243,00000000,004342CF), ref: 004330F5
SelectObject.GDI32(00000000,00000000,00000000,00000000,?,?,00435D27,?,?,?,?,00434243,00000000,004342CF), ref: 004330FE
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,00000000,?,?,00435D27,?,?,?,?,00434243), ref: 00433112
SelectObject.GDI32(00000000,00000000,00000000,00000000,00000100,?,00000000,00000000,00000000,00000000,?,?,00435D27), ref: 0043311E
DeleteDC.GDI32(00000000,00000000,00000000,00000000,00000000,00000100,?,00000000,00000000,00000000,00000000,?,?,00435D27), ref: 00433124
CreatePalette.GDI32(?,00000000,?,?,00435D27,?,?,?,?,00434243,00000000,004342CF), ref: 0043316B

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: aa396a31fa958ebfad3ce8b7b500d6b59ca48a68c873fd0aace0eaadba1eff5d
Instruction ID: 453880dea414254f5e70564addf5038a3b2e39fedb4e9689228aea3f87e1c906
Opcode Fuzzy Hash: aa396a31fa958ebfad3ce8b7b500d6b59ca48a68c873fd0aace0eaadba1eff5d
Instruction Fuzzy Hash: 8F01406120434066EB14AB6A9C43B6B72F89FC8719F14D82FB588A73D3E67C8D45835A

Uniqueness

Uniqueness Score: -1.00%

Function 00401B0C, Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,00401ADA), ref: 00401BC3
Sleep.KERNEL32(0000000A,00000000,?,00401ADA), ref: 00401BD9
Sleep.KERNEL32(00000000,?,?,?,00401ADA), ref: 00401C07
Sleep.KERNEL32(0000000A,00000000,?,?,?,00401ADA), ref: 00401C1D

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: da7dd678823fe16698e8621d05df6cc320e472973aadcc0d9625783984cb3673
Instruction ID: 2891e578ebe356eb20598668031130a8db32dcf09a58c405cd0a486b993cdbc5
Opcode Fuzzy Hash: da7dd678823fe16698e8621d05df6cc320e472973aadcc0d9625783984cb3673
Instruction Fuzzy Hash: ABC16972A042508BD715CF29DC8471EBBE0EB99320F18827FE8099B3F5C778A945DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00442D3C, Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00442D48
GetTextMetricsW.GDI32(?,?,00000000,00442DB2,?,00000000), ref: 00442D66
SelectObject.GDI32(?,00000000,?,?,00000000,00442DB2,?,00000000), ref: 00442D7B
GetTextMetricsW.GDI32(?,?,?,00000000,?,?,00000000,00442DB2,?,00000000), ref: 00442D8A
SelectObject.GDI32(?,00000000,?,?,?,00000000,?,?,00000000,00442DB2,?,00000000), ref: 00442D94
ReleaseDC.USER32(00000000,?,00442DB9,?,?,00000000,?,?,00000000,00442DB2,?,00000000), ref: 00442DAC

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsObjectSelectText$Release
String ID:
API String ID: 833910088-0
Opcode ID: 54bcdd8b1955f6fa4ffd854d0115cedc86d7fc3d2766759bb3e9fe87873a2700
Instruction ID: 276e67344c93cf8d77e35fe61be8e6db15498aac0124d6703ec495b6da0997b8
Opcode Fuzzy Hash: 54bcdd8b1955f6fa4ffd854d0115cedc86d7fc3d2766759bb3e9fe87873a2700
Instruction Fuzzy Hash: 2301D275A04244AFDB41EBE9CC52E9EBBFCEB0C704F510466B504E7292D6789D008B28

Uniqueness

Uniqueness Score: -1.00%

Function 004327C4, Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 004317A4: CreateBrushIndirect.GDI32(00000001,00000000,00431872), ref: 0043184F

UnrealizeObject.GDI32(00000000,00000001,00432731,?,?,?,00432063,00000001,?,?,00432570), ref: 004327D0
SelectObject.GDI32(00000000,00000000,00000000,00000001,00432731,?,?,?,00432063,00000001,?,?,00432570), ref: 004327E2
SetBkColor.GDI32(00000000,00000000,00000000,00000000,00000000,00000001,00432731,?,?,?,00432063,00000001,?,?,00432570), ref: 00432805
SetBkMode.GDI32(00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000001,00432731,?,?,?,00432063,00000001,?,?), ref: 00432810
SetBkColor.GDI32(00000000,00000000,00000000,00000000,00000000,00000001,00432731,?,?,?,00432063,00000001,?,?,00432570), ref: 0043282B
SetBkMode.GDI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000001,00432731,?,?,?,00432063,00000001,?,?), ref: 00432836

Part of subcall function 00430758: GetSysColor.USER32(?,00431848,00000000,00431872), ref: 00430762

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 6034cc268560bb267009a1058ce3f4d328edd99075b4d92227d5acc4c420714d
Instruction ID: b48eb7aad3187f855167a3e47d7ea41d18aac95b37d7222dcd999a32823daeba
Opcode Fuzzy Hash: 6034cc268560bb267009a1058ce3f4d328edd99075b4d92227d5acc4c420714d
Instruction Fuzzy Hash: FAF06FA5600140ABCF44FFAAD9C7D4777D85F48319B085456B504EF2A7CB79EC104B39

Uniqueness

Uniqueness Score: -1.00%

Function 004B26C4, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 245windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,00000000,00000000,00000000,00000000,004B2A55,?,00000000,004B2A93), ref: 004B2741
PostMessageW.USER32(00000000,00000000,00000000,00000000,00000000,004B2A55,?,00000000,004B2A93), ref: 004B2768
SetForegroundWindow.USER32(?,00000000,004B2A55,?,00000000,004B2A93), ref: 004B2779
DefWindowProcW.USER32(00000000,?,?,?,00000000,004B2A55,?,00000000,004B2A93), ref: 004B2A40

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 004B28BC

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MessagePostWindow$ForegroundProc
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 602442252-3182603685
Opcode ID: 9f608ac1c5e55586909c8b416c1c4f1d61013f7dd2b499ea3b7a2a6c70010d83
Instruction ID: c369a76b6136512ba87df0aaf976d88adf7f4c0fb1534fe5794129ded34b7be5
Opcode Fuzzy Hash: 9f608ac1c5e55586909c8b416c1c4f1d61013f7dd2b499ea3b7a2a6c70010d83
Instruction Fuzzy Hash: 7B91C134A04604AFE711DF68D951F9ABBB5FB4D700F10C5A6F909A77A1C678AD00CF28

Uniqueness

Uniqueness Score: -1.00%

Function 004368C4, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00436980
CreateHalftonePalette.GDI32(00000000,00000000), ref: 0043698D
ReleaseDC.USER32(00000000,00000000,00000000,00000000), ref: 0043699C
DeleteObject.GDI32(00000000,00436A17), ref: 00436A0A

Strings

(, xrefs: 00436937

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDeleteHalftoneObjectPaletteRelease
String ID: (
API String ID: 577518360-3887548279
Opcode ID: 397d6aff9f9ea3c7925a3db7dce077d00a18e4e547631acbbef4d5e884f193f5
Instruction ID: b4ab0e67c16d9db80ea102a5bed0a31ab8e2a9aac10f558a51326a7729ccbd61
Opcode Fuzzy Hash: 397d6aff9f9ea3c7925a3db7dce077d00a18e4e547631acbbef4d5e884f193f5
Instruction Fuzzy Hash: 6741E170A04209EFDB14DFA8C445BAEBBF6EF4D304F1180AAE404A7392D7789E05DB49

Uniqueness

Uniqueness Score: -1.00%

Function 004FF810, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 0047BFC0: SetWindowTextW.USER32(?,00000000,00000000,?,004FF846,00000000,004FFACA,?,?,00000000,?), ref: 0047BFF0

ShowWindow.USER32(?,00000005,00000000,004FFACA,?,?,00000000,?), ref: 004FF856

Part of subcall function 0047F7D8: GetSystemDirectoryW.KERNEL32(?,00000104,?,004FF876,00000000,004FFA91,?,?,00000005,00000000,004FFACA,?,?,00000000,?), ref: 0047F7EB

Part of subcall function 0040DD74: SetCurrentDirectoryW.KERNEL32(00000000,?,004FF87E,00000000,004FFA91,?,?,00000005,00000000,004FFACA,?,?,00000000,?), ref: 0040DD7F

Part of subcall function 0047F334: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,0047F3CB,?,?,?,00000001,?,004B109E,00000000,004B110B), ref: 0047F369

Strings

.dat, xrefs: 004FF89D
.msg, xrefs: 004FF8BC
Uninstall, xrefs: 004FF83C
IMsg, xrefs: 004FF92A

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: 29750de40c8f301323e9a6314ccfcdd2ba246e22b42b7b205beaa5bb2d6a0e68
Instruction ID: a5ffe1dde9861a55d4a5961499b448f4a78771dcd78014424a7a78ac0be233f3
Opcode Fuzzy Hash: 29750de40c8f301323e9a6314ccfcdd2ba246e22b42b7b205beaa5bb2d6a0e68
Instruction Fuzzy Hash: C9419374A006089FC700EFA5CC92AAE77B5FF49304F508076F904A7791DB79AD09DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00452C6C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000000,00000000,000000FF,00000030,00000000,00452D65,?,?,?,0045347D,004534B0,?,00452485), ref: 00452CED
SetMenuItemInfoW.USER32(00000000,00000000,000000FF,00000030,00000000,00000000,000000FF,00000030,00000000,00452D65,?,?,?,0045347D,004534B0), ref: 00452D45
DrawMenuBar.USER32(00000000,00000000,00000000,000000FF,00000030,00000000,00000000,000000FF,00000030,00000000,00452D65,?,?,?,0045347D,004534B0), ref: 00452D52

Strings

P, xrefs: 00452CA2
,, xrefs: 00452CC6

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$InfoItem$Draw
String ID: ,$P
API String ID: 3227129158-1419105988
Opcode ID: 948120ff33df6e51cb094d1dee051fdf1eeb11fdea5a92934541f742f79ffdde
Instruction ID: 1721ffe4e5644131e195b98f6d865fc990fea650ae78d59c19f82b412960e3e8
Opcode Fuzzy Hash: 948120ff33df6e51cb094d1dee051fdf1eeb11fdea5a92934541f742f79ffdde
Instruction Fuzzy Hash: CE21DF31A002089FEB119F68CD85B9E77B8EB46315F504267E814E7292D3B89D48CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004B220C, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000B06,00000000,00000000), ref: 004B2226
SendMessageW.USER32(00000000,00000B00,00000000,00000000,004B26C4,004B2200,00000000,00000B06,00000000,00000000), ref: 004B22C3

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 004B2252
Failed to create DebugClientWnd, xrefs: 004B228C
pOP, xrefs: 004B229B

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd$pOP
API String ID: 3850602802-145809875
Opcode ID: 01276707ec59886bb79505e5cae83caa3a56ad262c343a107a18cfa0c02edfc4
Instruction ID: e22f4c861ff3a2eaa7af58382477ba4e027a8b6ca8d497cd93535fa4d4ea5588
Opcode Fuzzy Hash: 01276707ec59886bb79505e5cae83caa3a56ad262c343a107a18cfa0c02edfc4
Instruction Fuzzy Hash: A31104B0600241AFE310EB68DD81B9E3BD4AB6A308F04456AF684DB3D1C7B85C04CB7A

Uniqueness

Uniqueness Score: -1.00%

Function 00437C0C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?,?,?,00000000,00437CF6), ref: 00437C29
FindWindowExW.USER32(00000000,00000000,OleMainThreadWndClass,00000000,?,?,00000000,00437CF6), ref: 00437C5A
GetWindowThreadProcessId.USER32(?,00000000,00000000,00000000,OleMainThreadWndClass,00000000,?,?,00000000,00437CF6), ref: 00437C93
GetCurrentThreadId.KERNEL32(?,00000000,00000000,00000000,OleMainThreadWndClass,00000000,?,?,00000000,00437CF6), ref: 00437C9A

Part of subcall function 00408F00: TlsGetValue.KERNEL32(00000000,00000000,004030E2,00000002,00405109,?,?,?,00000002,004051BA,00403127,0040316E,?,00000000), ref: 00408F25

Strings

OleMainThreadWndClass, xrefs: 00437C53

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Thread$CurrentFindProcessValue
String ID: OleMainThreadWndClass
API String ID: 973455579-3883841218
Opcode ID: 55070c5891068c0ce70c06b6e79864118ab819714d9f443f8840f8d9123dcf14
Instruction ID: 998690a47b51143915db202845e6a89a1de354c271efdc0fa5cc0ac6cf1bcab5
Opcode Fuzzy Hash: 55070c5891068c0ce70c06b6e79864118ab819714d9f443f8840f8d9123dcf14
Instruction Fuzzy Hash: 570184702046048ED7317776CA49BAA32959B4531DF1520BFF384AB2E7DE3C4C009BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00403E68, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00403E8A
RegQueryValueExW.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00403ED9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00403EBD
RegCloseKey.ADVAPI32(?,00403EE0,00000000,?,00000004,00000000,00403ED9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00403ED3

Strings

FPUMaskValue, xrefs: 00403EB4
SOFTWARE\Borland\Delphi\RTL, xrefs: 00403E80

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 8b2ebef2b32d1027257517beb0d2b269172abac719c4a041021236444d918a9a
Instruction ID: 04a70fe4e6bed6eff2ea72ab6caf70887b7a37517f4a8ea264a7476bba7c093f
Opcode Fuzzy Hash: 8b2ebef2b32d1027257517beb0d2b269172abac719c4a041021236444d918a9a
Instruction Fuzzy Hash: FD015275A40308BAE711DF91CD42BBEB7ECD708B01F600176BA04E65D0E6796A14D798

Uniqueness

Uniqueness Score: -1.00%

Function 00437974, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(3B0806EB,00000000,00437A3D), ref: 004379EC
DeleteCriticalSection.KERNEL32(0050BF08,3B0806EB,00000000,00437A3D), ref: 004379F6
DeleteCriticalSection.KERNEL32(0050BF20,0050BF08,3B0806EB,00000000,00437A3D), ref: 00437A00

Strings

8AP, xrefs: 00437A1A
X B, xrefs: 00437A0F, 00437A24

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Delete$CriticalSection$Object
String ID: 8AP$X B
API String ID: 378701848-3126747446
Opcode ID: 30ab1668fad25fe7d988adbeae6b146e35cd2501e2f494f466e19ec26d3c78f4
Instruction ID: 7b4806af5257386517da2198e5cee0d83e26a1bf8cf864b59f00d5f363b3f272
Opcode Fuzzy Hash: 30ab1668fad25fe7d988adbeae6b146e35cd2501e2f494f466e19ec26d3c78f4
Instruction Fuzzy Hash: CD010CB12141019BD310FB76EC8281D37A4E796748791447EB300B77E2CB7DAC0ADB59

Uniqueness

Uniqueness Score: -1.00%

Function 004B32BC, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF,00000000,004B333D), ref: 004B32EE
GetExitCodeProcess.KERNEL32(?,000000EC,00000001,00000001,00000000,000000FF,000000FF,00000000,004B333D), ref: 004B3311
CloseHandle.KERNEL32(?,004B3344,00000001,00000000,000000FF,000000FF,00000000,004B333D), ref: 004B3337

Strings

GetExitCodeProcess, xrefs: 004B331A
MsgWaitForMultipleObjects, xrefs: 004B32FD

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 9526ee7e044e587f1991b46411ddb6db2db15e9d954f6d0262120710a78bae4d
Instruction ID: 3fcd3d6225ed0ff8c526748f66c7d335b4186021fa0b5b4108137dfdc3c111d7
Opcode Fuzzy Hash: 9526ee7e044e587f1991b46411ddb6db2db15e9d954f6d0262120710a78bae4d
Instruction Fuzzy Hash: 80018434640200AFDB10EFAACC52E9F73E8DB85724F6041B6F910D77D1DA38AE009629

Uniqueness

Uniqueness Score: -1.00%

Function 004AEB8D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000020), ref: 004AEB9A
DeleteFileW.KERNEL32(00000000,00000000,00000020), ref: 004AEBA8
MoveFileW.KERNEL32(00000000,00000000,00000000,00000000,00000020), ref: 004AEBCB

Part of subcall function 004ADFA0: GetLastError.KERNEL32(00000000,004AEC5A,00000005,00000000,004AEC82,?,?,00000000,0050C17C,00000000,00000000,00000000,?,004FFFA7,00000000,004FFFC2), ref: 004ADFA3

Strings

MoveFile, xrefs: 004AEBD4
DeleteFile, xrefs: 004AEBB7

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: 09bbaa1c2ccb17c2f769ebdf69ab09d4f638bf7217e05bc544e2c13f7382fcb6
Instruction ID: 07b0356e1ddbd47b3dffeed4a315f28376baca3c2d15e1efd840d4f98a73f021
Opcode Fuzzy Hash: 09bbaa1c2ccb17c2f769ebdf69ab09d4f638bf7217e05bc544e2c13f7382fcb6
Instruction Fuzzy Hash: 8FF08131A182054EEB00FBB7984256E62E8EB55308F61443BB416E7693D93DEC11422D

Uniqueness

Uniqueness Score: -1.00%

Function 00406F50, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000105,?,?,?,0040DD71,004DAA00,00000000,004DAADC,?,00000000,004DAAFE), ref: 00406F87
SetCurrentDirectoryW.KERNEL32(?,00000105,?,?,?,0040DD71,004DAA00,00000000,004DAADC,?,00000000,004DAAFE), ref: 00406F8D
GetCurrentDirectoryW.KERNEL32(00000105,?,?,?,0040DD71,004DAA00,00000000,004DAADC,?,00000000,004DAAFE), ref: 00406F9C
SetCurrentDirectoryW.KERNEL32(?,00000105,?,?,?,0040DD71,004DAA00,00000000,004DAADC,?,00000000,004DAAFE), ref: 00406FAD

Strings

:, xrefs: 00406F6C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: ba0977059332a014b6037d484273f86c3e549f5397e68c220dfc60d22c279e08
Instruction ID: 2a2578a9873e554637340ad988b15cacb881584caf9c4433a20746dd45dae6f2
Opcode Fuzzy Hash: ba0977059332a014b6037d484273f86c3e549f5397e68c220dfc60d22c279e08
Instruction Fuzzy Hash: D8F024751403416AD310E7A08892AEB73DCEF44308F00883FBAC8D72E1E77C8958836B

Uniqueness

Uniqueness Score: -1.00%

Function 0041D56C, Relevance: 7.8, APIs: 5, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02cf38e27ee7a0ba86956831c03559e8119da3484652c5a317e58044076b7896
Instruction ID: fe92f61c7bfad4906ae1c6181656944a01e10617b54bfeeaa83320945d46d98f
Opcode Fuzzy Hash: 02cf38e27ee7a0ba86956831c03559e8119da3484652c5a317e58044076b7896
Instruction Fuzzy Hash: F5D1A3B5E00149EFCF00EF95C4819FEBBB5EF49710F5440A6E840AB251D638AE86DB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041C050, Relevance: 7.8, APIs: 5, Instructions: 271COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0041C0BC
VariantInit.OLEAUT32(?), ref: 0041C1D2

Part of subcall function 0041EEF0: EnterCriticalSection.KERNEL32(0050BE44,?,?,?,?,?,0041698B,?,?,?,004169BE,004169C6), ref: 0041EF26
Part of subcall function 0041EEF0: LeaveCriticalSection.KERNEL32(0050BE44,0041EF9F,?,0050BE44,?,?,?,?,?,0041698B,?,?,?,004169BE,004169C6), ref: 0041EF92

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalInitSectionVariant$EnterLeave
String ID:
API String ID: 2777075435-0
Opcode ID: c82cfee42df7d65b2fc762f2823cca216b97f8855fcd5510e62e24baec77f8e3
Instruction ID: cebb078ef7d3cfa8502e960ba1920c37ab51affcf265b0b4eba6eae6c3613b8c
Opcode Fuzzy Hash: c82cfee42df7d65b2fc762f2823cca216b97f8855fcd5510e62e24baec77f8e3
Instruction Fuzzy Hash: 72B13735A40208EFCF00EF95C8818EDB7B5EF49710FA145A6E800A7651D738AEC6DA29

Uniqueness

Uniqueness Score: -1.00%

Function 00472D8C, Relevance: 7.7, APIs: 5, Instructions: 181COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00000000,?,00000000), ref: 00472E5F
MulDiv.KERNEL32(?,00000000,00000000), ref: 00472EEE
MulDiv.KERNEL32(?,00000000,00000000), ref: 00472F1D
MulDiv.KERNEL32(?,00000000,00000000), ref: 00472F4C
MulDiv.KERNEL32(?,00000000,00000000,?,00000000,00000000), ref: 00472F6F

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dc2dd8acad349d3ca3bf8fdf9294b832968618daf115d756875f7046609f678
Instruction ID: 77f1c63b8bd7ab3ae33258696c436569c8a259cdf4245de983d1230fff8df793
Opcode Fuzzy Hash: 4dc2dd8acad349d3ca3bf8fdf9294b832968618daf115d756875f7046609f678
Instruction Fuzzy Hash: A181C874A00144EFDB04DB99C689E9EB7F5BF49304F2581F6E808DB362D774AE44AB44

Uniqueness

Uniqueness Score: -1.00%

Function 0046A148, Relevance: 7.7, APIs: 5, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00431F24: FillRect.USER32(?,?,00000000,?,?), ref: 00431F4D

CreateRectRgn.GDI32(?,?,?,?), ref: 0046A1B4
SelectObject.GDI32(00000000,?,?,?,?,?), ref: 0046A1CF

Part of subcall function 004317A4: CreateBrushIndirect.GDI32(00000001,00000000,00431872), ref: 0043184F

FrameRgn.GDI32(00000000,?,00000000,00000001,00000001,00000000,0046A370,?,00000000,?,?,?,?,?), ref: 0046A221
SelectObject.GDI32(00000000,?,0046A377), ref: 0046A361
DeleteObject.GDI32(?,00000000,?,0046A377), ref: 0046A36A

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$CreateRectSelect$BrushDeleteFillFrameIndirect
String ID:
API String ID: 3847799725-0
Opcode ID: d5ee4fec679b97f2a8f89083df51bbba07cd2ba0257155db1a9d683beeda1269
Instruction ID: f17388e5dafc237b5349814676a2e3675fe6a84bfa189cf02eab24bba58d15d3
Opcode Fuzzy Hash: d5ee4fec679b97f2a8f89083df51bbba07cd2ba0257155db1a9d683beeda1269
Instruction Fuzzy Hash: B771A234A0050AEFCB00DFA8C985EDEB3F9AF09304F1544A6F914AB362D775AE06DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00425234, Relevance: 7.6, APIs: 5, Instructions: 142COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,00000000,004253D6), ref: 00425294
CharNextW.USER32(?,?,00000000,004253D6), ref: 0042533C
CharNextW.USER32(?,?,00000000,004253D6), ref: 00425361
CharNextW.USER32(00000000,?,?,00000000,004253D6), ref: 00425379

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: c6b224d2d79e2def6d035914c7a93e47bb2b5898cc6e62bc0565dc17fe0df34b
Instruction ID: 7e89c3d01ba77d3526db27aa5644472d7627d550721ce9853e3e24152c47c060
Opcode Fuzzy Hash: c6b224d2d79e2def6d035914c7a93e47bb2b5898cc6e62bc0565dc17fe0df34b
Instruction Fuzzy Hash: 35513A30B00A24DFCF15EF69E480A6DB7B1EF06354B9111E6E801DB3A5D7B8AD81CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00471B40, Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

FlatSB_SetScrollProp.COMCTL32(00000000,00000001,?,00000000,?,00000000,?,00471CF5,?,?,?,?), ref: 00471B7E
FlatSB_SetScrollProp.COMCTL32(00000000,00000001,?,00000000,00000000,00000001,?,00000000,?,00000000,?,00471CF5,?,?,?,?), ref: 00471BAF
FlatSB_SetScrollProp.COMCTL32(00000000,00000001,?,00000000,00000000,00000001,?,00000000,?,00000000,?,00471CF5,?,?,?,?), ref: 00471BE0
FlatSB_SetScrollProp.COMCTL32(00000000,00000001,?,00000000,00000000,00000001,?,00000000,?,00000000,?,00471CF5,?,?,?,?), ref: 00471C11
FlatSB_SetScrollProp.COMCTL32(00000000,?,00000000,00000000,00000000,00000001,?,00000000,?,00000000,?,00471CF5,?,?,?,?), ref: 00471C3F

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FlatPropScroll
String ID:
API String ID: 3625857538-0
Opcode ID: 7638cc7ab83ee625a574eab4a4609e2530cb4982dc8d0596b7edc3d200851696
Instruction ID: 4b9a3b0e7be246836fe3db809dd58f5fe569eb827052d96f97dfc1626a517f10
Opcode Fuzzy Hash: 7638cc7ab83ee625a574eab4a4609e2530cb4982dc8d0596b7edc3d200851696
Instruction Fuzzy Hash: 363104706400989FD750EF9ED881E5577E8AF2D30AB15049AF288CB362D33AEE54CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00437CE0, Relevance: 7.6, APIs: 5, Instructions: 86windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00437C0C: IsWindow.USER32(?,?,?,00000000,00437CF6), ref: 00437C29
Part of subcall function 00437C0C: FindWindowExW.USER32(00000000,00000000,OleMainThreadWndClass,00000000,?,?,00000000,00437CF6), ref: 00437C5A
Part of subcall function 00437C0C: GetWindowThreadProcessId.USER32(?,00000000,00000000,00000000,OleMainThreadWndClass,00000000,?,?,00000000,00437CF6), ref: 00437C93
Part of subcall function 00437C0C: GetCurrentThreadId.KERNEL32(?,00000000,00000000,00000000,OleMainThreadWndClass,00000000,?,?,00000000,00437CF6), ref: 00437C9A

MsgWaitForMultipleObjectsEx.USER32(?,?,?,000000BF,?), ref: 00437D0E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001,?,?,?,000000BF,?), ref: 00437D29
TranslateMessage.USER32(?,?,00000000,00000000,00000000,00000001,?,?,?,000000BF,?), ref: 00437D36
DispatchMessageW.USER32(?,?,?,00000000,00000000,00000000,00000001,?,?,?,000000BF,?), ref: 00437D3F
WaitForMultipleObjectsEx.KERNEL32(?,?,?,?,00000000), ref: 00437D6B

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageWindow$MultipleObjectsThreadWait$CurrentDispatchFindPeekProcessTranslate
String ID:
API String ID: 2725875890-0
Opcode ID: fc572c3e098649195af308007f8e043adef49e2482a442dab9c82acdaf012186
Instruction ID: 817bdcf35217bbf3b8350ff0b953c5b841f9b68ca30ea8cb430303c19267dab9
Opcode Fuzzy Hash: fc572c3e098649195af308007f8e043adef49e2482a442dab9c82acdaf012186
Instruction Fuzzy Hash: 682162B1604209ABDB60DEA4CC85FAB73A8EF09310F10552AFA45D7281D67DDD4087A9

Uniqueness

Uniqueness Score: -1.00%

Function 0044E2EC, Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2d042711eec56587d602c91b0c162b72bde29da2397229d05545a73a953c31
Instruction ID: a2ad33e1273d2ee1fb8b79a06fbb0284983e3d2605d6a52be52423783f2746c3
Opcode Fuzzy Hash: 7f2d042711eec56587d602c91b0c162b72bde29da2397229d05545a73a953c31
Instruction Fuzzy Hash: B31160217047499AFB216E3B8845B5F7798BF81748F0444AFBC469B383CA3CDC06869C

Uniqueness

Uniqueness Score: -1.00%

Function 00435CDC, Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D32
GetDeviceCaps.GDI32(00000000,0000000C,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D47
GetDeviceCaps.GDI32(00000000,0000000E,00000000,0000000C,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D51
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D75
ReleaseDC.USER32(00000000,00000000,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D80

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: b83684b5ba9f85ad99269feed3af0562fc0b11e7e96e9a9012feb6ec1349e9a9
Instruction ID: 5c2809fdb905d37f565b235fed2726c2730ff81ba6de4555d01415a6d50e697e
Opcode Fuzzy Hash: b83684b5ba9f85ad99269feed3af0562fc0b11e7e96e9a9012feb6ec1349e9a9
Instruction Fuzzy Hash: A311D62160069A9EEB20EF3588457FF37D0AF08755F04612BF8009A3C2D7BC8C91C3A9

Uniqueness

Uniqueness Score: -1.00%

Function 00433044, Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0043305C
GetDeviceCaps.GDI32(?,00000068,00000000,004330CA,?,00000000), ref: 00433078
GetPaletteEntries.GDI32(3B0806EB,00000000,00000008,?,?,00000068,00000000,004330CA,?,00000000), ref: 00433090
GetPaletteEntries.GDI32(3B0806EB,00000008,00000008,?,3B0806EB,00000000,00000008,?,?,00000068,00000000,004330CA,?,00000000), ref: 004330A8
ReleaseDC.USER32(00000000,?,004330D1,004330CA,?,00000000), ref: 004330C4

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: 3cb5684859ab9ae1d519d7e4299f1897763451c90180c387dc0536ad1d9f00c5
Instruction ID: 5d5c02e83f5e6618134617745de3418d218addccce8ed8bece408fd8e459495c
Opcode Fuzzy Hash: 3cb5684859ab9ae1d519d7e4299f1897763451c90180c387dc0536ad1d9f00c5
Instruction Fuzzy Hash: 5C110C716483446EFB44CF95CC86F6D77ECE708705F10805BF604DA2D2DA7A5544C724

Uniqueness

Uniqueness Score: -1.00%

Function 004112BC, Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00411353,?,?,00000000), ref: 004112D4

Part of subcall function 00411030: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041104E

GetThreadLocale.KERNEL32(00000000,00000004,00000000,00411353,?,?,00000000), ref: 00411304
EnumCalendarInfoW.KERNEL32(Function_00011208,00000000,00000000,00000004,00000000,00411353,?,?,00000000), ref: 0041130F
GetThreadLocale.KERNEL32(00000000,00000003,Function_00011208,00000000,00000000,00000004,00000000,00411353,?,?,00000000), ref: 0041132D
EnumCalendarInfoW.KERNEL32(Function_00011244,00000000,00000000,00000003,Function_00011208,00000000,00000000,00000004,00000000,00411353,?,?,00000000), ref: 00411338

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: f3c33352c88c2db20ca78f7275b85e416aefa7c625fba4615c6e6c6fedc00475
Instruction ID: e498c0403ab6fef1c4db5f8672c89691ea4b39d097b48d2ba429c340c4a891cd
Opcode Fuzzy Hash: f3c33352c88c2db20ca78f7275b85e416aefa7c625fba4615c6e6c6fedc00475
Instruction Fuzzy Hash: 4801F7716002086AE301E765CD13FDF7258DB46B18F600577FA10F6AFADA7D9E4181AC

Uniqueness

Uniqueness Score: -1.00%

Function 0047A6AC, Relevance: 7.5, APIs: 5, Instructions: 25synchronizationthreadCOMMON

Download Yara Rule

APIs

UnhookWindowsHookEx.USER32(00000000,0047D64E,00000000,0047C1D7,?,00000000,?,00000001,0047C3DD,?,00000000,00000200,0000020A,00000001), ref: 0047A6BB
SetEvent.KERNEL32(00000000,0047D64E,00000000,0047C1D7,?,00000000,?,00000001,0047C3DD,?,00000000,00000200,0000020A,00000001), ref: 0047A6D6
GetCurrentThreadId.KERNEL32(00000000,0047D64E,00000000,0047C1D7,?,00000000,?,00000001,0047C3DD,?,00000000,00000200,0000020A,00000001), ref: 0047A6DB
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0047D64E,00000000,0047C1D7,?,00000000,?,00000001,0047C3DD,?,00000000,00000200,0000020A,00000001), ref: 0047A6F0
CloseHandle.KERNEL32(00000000,00000000,0047D64E,00000000,0047C1D7,?,00000000,?,00000001,0047C3DD,?,00000000,00000200,0000020A,00000001), ref: 0047A6FB

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCurrentEventHandleHookObjectSingleThreadUnhookWaitWindows
String ID:
API String ID: 2429646606-0
Opcode ID: f67b66ca434d8a576fbf8ec486b76f18478964696b8acf65c0c4de72e67ef7f9
Instruction ID: 15312453f39450ece5dd7abeeafb8575d04830126700f464afa8735e4cd20f93
Opcode Fuzzy Hash: f67b66ca434d8a576fbf8ec486b76f18478964696b8acf65c0c4de72e67ef7f9
Instruction Fuzzy Hash: 48F0C7715102009AD710EFB5DC46A5E3BA4D757318F144B26B218DB2E3D6389859EB15

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8C0, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 249shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameW.MPR(00000000,00000001,?,00000400,00000000,0040DC15), ref: 0040D930
WNetOpenEnumW.MPR(00000001,00000001,00000000,00000000,?,00000000,0040DC15), ref: 0040DA36
WNetEnumResourceW.MPR(?,FFFFFFFF,?,?,00000000,0040DBCA,?,00000000,0040DBE8,?,00000001,00000001,00000000,00000000,?,00000000), ref: 0040DA8E

Strings

Z, xrefs: 0040D991

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: 931b992a17b1b58d09d43a1f5dbdc1c4aac951f733749b7d23384e1367808f24
Instruction ID: 9827094f3c3e53e9c0531f242176f67b9bce1fde8aaf7ddc72a0c5785e9ee46f
Opcode Fuzzy Hash: 931b992a17b1b58d09d43a1f5dbdc1c4aac951f733749b7d23384e1367808f24
Instruction Fuzzy Hash: E8A15C70E00209DBCB10EFA9C941AEEB3B5EF49304F11417AE501B7295D778AE89DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411370, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 177threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,004115A3,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004113AB

Part of subcall function 00411030: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041104E

Strings

yyyy, xrefs: 004114DA
eeee, xrefs: 004114F6
ggg, xrefs: 004114CA

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 1462dfc372af59af164afe74bc811ce6aa13f44484b62b6b09851293dcaf5bc7
Instruction ID: 818ab064cb691a628fac44f09a960eb45dc7c2328c387e1c5c3f7b64323134e2
Opcode Fuzzy Hash: 1462dfc372af59af164afe74bc811ce6aa13f44484b62b6b09851293dcaf5bc7
Instruction Fuzzy Hash: E3519A35B001059BCB10EBA9C5825EFB3A6DF80744F21807BE602A73B5D73CDD969659

Uniqueness

Uniqueness Score: -1.00%

Function 004A7104, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 004A7191
DrawTextW.USER32(00000000,00000000,?,?,00000D20,?), ref: 004A71C6
DrawTextW.USER32(?,00000000,?,00000000,00000800), ref: 004A7258

Strings

, xrefs: 004A7176

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: ef9e2f64df9b07427466d3b073a4c9bae9fa140cf6399ae123ceb23bd9dc4339
Instruction ID: 138f72ce3a8b51e981c649fc5243cef3cd0f642bc7b23586aeb55cc5a5716f0c
Opcode Fuzzy Hash: ef9e2f64df9b07427466d3b073a4c9bae9fa140cf6399ae123ceb23bd9dc4339
Instruction Fuzzy Hash: 23518071A042089FDB11CFA4C8857EEBBF4BF49314F14447AE805E7352C778AA45CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004810AC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000,00000000,00481207,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 004810D6
SelectObject.GDI32(?,00000000,00000000,004811E5,?,00000000,00000000,00481207,?,?,?,?,00000000,00000000,00000000,00000000), ref: 004810F9
ReleaseDC.USER32(00000000,?,004811EC,00000000,004811E5,?,00000000,00000000,00481207,?,?,?,?,00000000,00000000,00000000), ref: 004811DF

Strings

...\, xrefs: 00481191

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectReleaseSelect
String ID: ...\
API String ID: 1831053106-983595016
Opcode ID: 25f398d7cf2b427e95a463aafaeb5f6360995d4a22e5e059a588a9f28880c37f
Instruction ID: a580d2a2e0a05b2a978b4963986bd30c7b07e45b75797929e60b4e56edc20f2e
Opcode Fuzzy Hash: 25f398d7cf2b427e95a463aafaeb5f6360995d4a22e5e059a588a9f28880c37f
Instruction Fuzzy Hash: 48317230A00108AFDB11EB99C885B9EB7B9EB4C704F5148BBF500E72A1D7789E41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004AE464, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,004AE59F), ref: 004AE54F
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,004AE59F), ref: 004AE55F

Strings

_iu, xrefs: 004AE4F1
.tmp, xrefs: 004AE503

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: ea47a6930f28bb406acc14c6a8c051aa1ba3d60a64c826ff7db12a937ffc6d79
Instruction ID: 3a468ab47f98d1b1beb0c68c454d8a8e1f3415f888dbd3084e190576ca2fb4fc
Opcode Fuzzy Hash: ea47a6930f28bb406acc14c6a8c051aa1ba3d60a64c826ff7db12a937ffc6d79
Instruction Fuzzy Hash: A831A630E00208ABDB10EBA6D842BDDB7B8AF55308F51816AE914773C1D77C6E019B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0047D00C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103timethreadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0047CF80: GetCursorPos.USER32 ref: 0047CF87

SetTimer.USER32(00000000,00000000,503B0C55,00000000,00000000,0047D11C,?,00000000,0047D175,?,?,?,00000000), ref: 0047D0F7
GetCurrentThreadId.KERNEL32(00000000,0047D175,?,?,?,00000000), ref: 0047D131
WaitMessage.USER32(00000000,0047D175,?,?,?,00000000), ref: 0047D155

Strings

<pP, xrefs: 0047D136

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentCursorMessageThreadTimerWait
String ID: <pP
API String ID: 3909455694-2523196900
Opcode ID: 4cb84703ede7eefb8a35778c5c57ca6a90fa9a2d08076377494cf2dc03b3b5f0
Instruction ID: 1894314fdf6f7f3ac9dc0e3c1148310b7e34f63d9e14fb40f06c055733b464aa
Opcode Fuzzy Hash: 4cb84703ede7eefb8a35778c5c57ca6a90fa9a2d08076377494cf2dc03b3b5f0
Instruction Fuzzy Hash: 6F418D30A14204EFDB11DF64D846BDE7BF6EF09308F9180AAE808A7392C7795E04DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004FFDF8, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,00000000,004FFEF8,?,?,00000000,0050C17C,00000000,00000000,00000000,00500375,?,?,00000005,?), ref: 004FFE6A
SetFileAttributesW.KERNEL32(00000000,00000000,00000000,?,00000000,004FFEF8,?,?,00000000,0050C17C,00000000,00000000,00000000,00500375,?,?), ref: 004FFE93
MoveFileExW.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,004FFEF8,?,?,00000000,0050C17C,00000000,00000000,00000000,00500375), ref: 004FFEAC

Strings

isRS-%.3u.tmp, xrefs: 004FFE49

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: cf694a0039044c17e45b6ed068600fc2c2b872d423a32e8d7c1c824a0d2e0aa9
Instruction ID: b58f8eff94b56a114fc0f447de81b10eb337f7d8e9f1cc94bf1ab759b0606aac
Opcode Fuzzy Hash: cf694a0039044c17e45b6ed068600fc2c2b872d423a32e8d7c1c824a0d2e0aa9
Instruction Fuzzy Hash: 54318231D00219AFCB04EBAAC8819AEB7B8AF44318F51457BB915B36D2D7389E15866C

Uniqueness

Uniqueness Score: -1.00%

Function 0040F954, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,0040FA45), ref: 0040F9DC
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,0040FA45), ref: 0040F9E2

Strings

yyyy, xrefs: 0040F9B7
, xrefs: 0040F9A8

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 490d0cef3944787b5bb441e17e030719b60f8d54242dcb6018657d97bf63f21b
Instruction ID: a0cbe894a2d15a482b2bc7ee58c4f9b86db6e91c77058163e84286a9ee09c91d
Opcode Fuzzy Hash: 490d0cef3944787b5bb441e17e030719b60f8d54242dcb6018657d97bf63f21b
Instruction Fuzzy Hash: FB215575B101189FCB21DF55C851AAEB3B5EF48700F514077F809F7691D6389E448B69

Uniqueness

Uniqueness Score: -1.00%

Function 004DA724, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 0047BFC0: SetWindowTextW.USER32(?,00000000,00000000,?,004FF846,00000000,004FFACA,?,?,00000000,?), ref: 0047BFF0

GetFocus.USER32(?,00000000,004DA7CC,?,00000000,004DA7F3), ref: 004DA78E
GetKeyState.USER32(0000007A,?,00000000,004DA7CC,?,00000000,004DA7F3), ref: 004DA7A5
WaitMessage.USER32(?,00000000,004DA7CC,?,00000000,004DA7F3), ref: 004DA7AF

Strings

Wnd=$%x, xrefs: 004DA770

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: 1c1500d9faa661e4eaf398de83853ed9c42146ff8800a7bf342f0f45df2375c4
Instruction ID: ae80d7189922e66726502b01c46797bc835767e67adf418e1739b68b1ce7fea9
Opcode Fuzzy Hash: 1c1500d9faa661e4eaf398de83853ed9c42146ff8800a7bf342f0f45df2375c4
Instruction Fuzzy Hash: 3711C1346002049FC701EF65D8A2A9EBBF8EB49704B5185BBF804E3391D738AE14DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004A6820, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 004A67F0: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004A6808

LoadLibraryW.KERNEL32(00000000,00000000,004A68DE,?,?,00000000,00000000), ref: 004A6868

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,00000000,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409666

Strings

LresultFromObject, xrefs: 004A6873
CreateStdAccessibleObject, xrefs: 004A6883
oleacc.dll, xrefs: 004A6855

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2141747552-1050967733
Opcode ID: 4c9c9e9881132015831bb739bbee64db24a7a1f679338a1f6f305b42fc55685a
Instruction ID: a799397437fd441cc99133b32f51302e126695908482f8dc87e05caa4082c355
Opcode Fuzzy Hash: 4c9c9e9881132015831bb739bbee64db24a7a1f679338a1f6f305b42fc55685a
Instruction Fuzzy Hash: C0110434501705AED710FFA1CC42B5D77ACE723718F52063EA400669E1C77C5908DA08

Uniqueness

Uniqueness Score: -1.00%

Function 004B1CE8, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047E754: GetFullPathNameW.KERNEL32(00000000,00001000,?,?,00000002,?,?,00000000,00000000,004AE99B,00000000,004AEC82,?,?,00000000,0050C17C), ref: 0047E785

LoadTypeLib.OLEAUT32(00000000,00000000,00000000,004B1D82,?,00000000,00000000,00000000,00000000,?,0050024C,00000000,00500262,?,000000EC,00000000), ref: 004B1D2B
RegisterTypeLib.OLEAUT32(?,00000000,00000000,00000000,00000000,00000000,004B1D82,?,00000000,00000000,00000000,00000000,?,0050024C,00000000,00500262), ref: 004B1D47

Strings

RegisterTypeLib, xrefs: 004B1D52
LoadTypeLib, xrefs: 004B1D36

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Type$FullLoadNamePathRegister
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 4170313675-2435364021
Opcode ID: 9791b0faade85fbefc20417072859eadab0b44f9a020765e96e94cc3baf2f716
Instruction ID: 9f6a19a158d559a1cc7885e53d67bbcd0b75cada2b89cde6785d72465e612173
Opcode Fuzzy Hash: 9791b0faade85fbefc20417072859eadab0b44f9a020765e96e94cc3baf2f716
Instruction Fuzzy Hash: CA012534A40204BED710FB66DD52BDEB3ACDB44748F914477B505E6292DB78AE048668

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA2C, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00400000,CHARTABLE,0000000A,?,?,0040A9F4,00000000,00451B55,00000000,00451C6F,?,?,?,00000000), ref: 0040AA40
LoadResource.KERNEL32(00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040A9F4,00000000,00451B55,00000000,00451C6F,?,?,?,00000000), ref: 0040AA57
LockResource.KERNEL32(00000000,00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040A9F4,00000000,00451B55,00000000,00451C6F,?,?,?), ref: 0040AA68

Part of subcall function 0041362C: GetLastError.KERNEL32(0040AA79,00000000,00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040A9F4,00000000,00451B55,00000000,00451C6F), ref: 0041362C

Strings

CHARTABLE, xrefs: 0040AA35

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$ErrorFindLastLoadLock
String ID: CHARTABLE
API String ID: 1074440638-2668339182
Opcode ID: 2703275aedc38ddd2404200447d20f09f8df9942ed4efaceb6f0bd42bb58e2dc
Instruction ID: 5a4f828980dc0c07fe0bd09f448197a5a4bb917199cfd21898d88fc530485f59
Opcode Fuzzy Hash: 2703275aedc38ddd2404200447d20f09f8df9942ed4efaceb6f0bd42bb58e2dc
Instruction Fuzzy Hash: 170180B87043008FCB18EFA5E990A6E77A6BBAC324709453EE146573A7C73C9804DB18

Uniqueness

Uniqueness Score: -1.00%

Function 004FC644, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll), ref: 004FC654

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,00000000,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409666

Strings

MonitorFromRect, xrefs: 004FC65B
GetMonitorInfoA, xrefs: 004FC668
user32.dll, xrefs: 004FC64F

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: a6d3531628636ee8db843830e721e0886df5a4d9f88f5ff7195f4fd41b03b8bd
Instruction ID: d983cdb48d111c4ff86cd19e2bf833060f5dd31ac9216ed213a867bd27e09525
Opcode Fuzzy Hash: a6d3531628636ee8db843830e721e0886df5a4d9f88f5ff7195f4fd41b03b8bd
Instruction Fuzzy Hash: F0F0B462A49B1C27E21169664EC2E7B658C8F85751F142437BE04EA282E9AE8C0442EE

Uniqueness

Uniqueness Score: -1.00%

Function 004B4B80, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FDB8: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,0048048E,?,00000000,?,0048042E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0048048E), ref: 0047FDD4

RegCloseKey.ADVAPI32(00000000,?,00000001,00000000,00000003,004B4B6C,00000003,00000000,004B4D23,00000000,004B4EDD,?,004B4B6C,?,00000000,00000000), ref: 004B4BCD

Strings

InstallRoot, xrefs: 004B4BBC
SOFTWARE\Microsoft\.NETFramework, xrefs: 004B4BA0
.NET Framework not found, xrefs: 004B4BDC

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: cdb33a2276f15d31451dc03bd339c007f52e4f6b43e98f2e2e1067fa02e29f5c
Instruction ID: b6523baf0cd78ae7fd6b1fde410e8ea2ecd1305e83288d78558248172cc710d2
Opcode Fuzzy Hash: cdb33a2276f15d31451dc03bd339c007f52e4f6b43e98f2e2e1067fa02e29f5c
Instruction Fuzzy Hash: 19F0AF217481105BE714AB1AD881B8B3A98ABE6715F51843FB689CB292C738DC05C76A

Uniqueness

Uniqueness Score: -1.00%

Function 00480A70, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00504F70,004B22AA,004B26C4,004B2200,00000000,00000B06,00000000,00000000), ref: 00480A89

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

InterlockedExchange.KERNEL32(0050C1B0,00000001,00000000,user32.dll,ChangeWindowMessageFilterEx,00000004,00504F70,004B22AA,004B26C4,004B2200,00000000,00000B06,00000000,00000000), ref: 00480AA0

Part of subcall function 004809DC: GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,00480AC4,00000004,00504F70,004B22AA,004B26C4,004B2200,00000000,00000B06,00000000,00000000), ref: 004809F2
Part of subcall function 004809DC: InterlockedExchange.KERNEL32(0050C1A8,00000001,00000000,user32.dll,ChangeWindowMessageFilter,?,00480AC4,00000004,00504F70,004B22AA,004B26C4,004B2200,00000000,00000B06,00000000,00000000), ref: 00480A09

Strings

user32.dll, xrefs: 00480A84
ChangeWindowMessageFilterEx, xrefs: 00480A7F

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ExchangeHandleInterlockedModule$AddressProc
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 2897153734-2676053874
Opcode ID: c8db42570394d8d7e60c1e4fae6db28df9f551a9a1737b8b22b0be9d296c7bf2
Instruction ID: 91d07899984fe0f554a4e55fd0e6e76aba16ab09487d18c673ccf38c2a7208ba
Opcode Fuzzy Hash: c8db42570394d8d7e60c1e4fae6db28df9f551a9a1737b8b22b0be9d296c7bf2
Instruction Fuzzy Hash: CEE092B17613107AE654B7B56C86B9F2A489BA575AF104927F100A11D3D3BD0C48DB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00465A50, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,h\F,?,00000000), ref: 00465A68
GetWindowRect.USER32(?,?,?,h\F,?,00000000), ref: 00465A72

Strings

h\F, xrefs: 00465A5A
h\F, xrefs: 00465A63, 00465A77, 00465A66

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientRectScreenWindow
String ID: h\F$h\F
API String ID: 3371951266-1777331349
Opcode ID: 8480e256db6a65885bac2e8be1f84c6facc3a6147d4c49368ee715a94927c0a6
Instruction ID: 8ce6122bd64a8aed08cd494f6c5c4dbc819c454ad3d06b4d5a6483cc2c34fa53
Opcode Fuzzy Hash: 8480e256db6a65885bac2e8be1f84c6facc3a6147d4c49368ee715a94927c0a6
Instruction Fuzzy Hash: F3F0A2B190020DAFCB00DFE9D9818DEFBFCEB08210F10416AA945E3341D630AE408BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004809DC, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,00480AC4,00000004,00504F70,004B22AA,004B26C4,004B2200,00000000,00000B06,00000000,00000000), ref: 004809F2

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

InterlockedExchange.KERNEL32(0050C1A8,00000001,00000000,user32.dll,ChangeWindowMessageFilter,?,00480AC4,00000004,00504F70,004B22AA,004B26C4,004B2200,00000000,00000B06,00000000,00000000), ref: 00480A09

Strings

user32.dll, xrefs: 004809ED
ChangeWindowMessageFilter, xrefs: 004809E8

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: 2eca47cf8b0fbe0636f1b929708a60fb0751e3a17262874b9bee8fa565128678
Instruction ID: f1602fbd534eab049ebfa26696d625d76929397e69f749e56804fe0767585be2
Opcode Fuzzy Hash: 2eca47cf8b0fbe0636f1b929708a60fb0751e3a17262874b9bee8fa565128678
Instruction Fuzzy Hash: 5FE01270660300BEFA58BBB66C9AB5F2A54A766705F105927B001713D3C7FE488CEB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0046A7CC, Relevance: 6.2, APIs: 4, Instructions: 248sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,00000000,0046ABC2), ref: 0046A840
ShowWindow.USER32(00000000,00000004,?,00000000,0046ABC2), ref: 0046A888

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ShowSleepWindow
String ID:
API String ID: 4218995503-0
Opcode ID: ac1a8e4470d48d39143b0ce2bd370e0ba85586cbbf088aeb89242b4475db4e4e
Instruction ID: 7e2907adfba8db6dac9cb09b580910a553c6548edf38e547f8eb56bbff122cd0
Opcode Fuzzy Hash: ac1a8e4470d48d39143b0ce2bd370e0ba85586cbbf088aeb89242b4475db4e4e
Instruction Fuzzy Hash: 90917D70B00644AFDB10DF69D841E6EB7F4EF09704F1104A6F500AB3A2EA39AE14DF16

Uniqueness

Uniqueness Score: -1.00%

Function 00458BF4, Relevance: 6.2, APIs: 4, Instructions: 212COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32(00000000,00000000), ref: 00458C69
GetDesktopWindow.USER32(?), ref: 00458D99
SetCursor.USER32(00000000), ref: 00458DEE

Part of subcall function 00465CB8: ImageList_EndDrag.COMCTL32(?,-0000000C,00458DC9), ref: 00465CD4

SetCursor.USER32(00000000), ref: 00458DD9

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CursorDesktopWindow$DragImageList_
String ID:
API String ID: 617806055-0
Opcode ID: c891238c8e307f7384be93044dbe44e0081b001bd97c48d7fce6336162eadcac
Instruction ID: 463f46965f66266c2d1551f24f937379e76a6b9d10f61ea37853499231306e8a
Opcode Fuzzy Hash: c891238c8e307f7384be93044dbe44e0081b001bd97c48d7fce6336162eadcac
Instruction Fuzzy Hash: F2913D746002408FC714DF29D885B1A7BF1BBAA305F14829AE8449B377DB78EC4EDB95

Uniqueness

Uniqueness Score: -1.00%

Function 0045865C, Relevance: 6.1, APIs: 4, Instructions: 136threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00458A9C: WindowFromPoint.USER32(-000000F4,?,?,00458676,?,-0000000C,?), ref: 00458AA2
Part of subcall function 00458A9C: GetParent.USER32(00000000,-000000F4,?,?,00458676,?,-0000000C,?), ref: 00458AB9

GetWindow.USER32(00000000,00000004,?,-0000000C,?), ref: 0045867E
GetCurrentThreadId.KERNEL32(004585FC,?,00000000,00000004,?,-0000000C,?), ref: 00458755
EnumThreadWindows.USER32(00000000,004585FC,?,00000000,00000004,?,-0000000C,?), ref: 0045875B
GetWindowRect.USER32(00000000,?,00000000,004585FC,?,00000000,00000004,?,-0000000C,?), ref: 00458772

Part of subcall function 00457908: GetWindowThreadProcessId.USER32(00000000,?,?,00000000,00000000,0047DFFD,?,00000000,?,00000001,0047C3D0,?,00000000,00000200,0000020A,00000001), ref: 00457915
Part of subcall function 00457908: GetCurrentProcessId.KERNEL32(00000000,?,?,00000000,00000000,0047DFFD,?,00000000,?,00000001,0047C3D0,?,00000000,00000200,0000020A,00000001), ref: 0045791E
Part of subcall function 00457908: GlobalFindAtomW.KERNEL32(00000000,00000000,?,?,00000000,00000000,0047DFFD,?,00000000,?,00000001,0047C3D0,?,00000000,00000200,0000020A), ref: 00457933
Part of subcall function 00457908: GetPropW.USER32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,0047DFFD,?,00000000,?,00000001,0047C3D0,?,00000000), ref: 0045794A

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Thread$CurrentProcess$AtomEnumFindFromGlobalParentPointPropRectWindows
String ID:
API String ID: 349414421-0
Opcode ID: b0833e5095f65d1858646f76c9dbb643509b872239c9dfc130182e7313c843dd
Instruction ID: 856a3fe14221981f6e213ebf555dd32eee5e0548a2743c5c689853030cd9c08a
Opcode Fuzzy Hash: b0833e5095f65d1858646f76c9dbb643509b872239c9dfc130182e7313c843dd
Instruction Fuzzy Hash: E8513D757002459FCB00DFA9C881AAEB7B4AB59345F20816AEC14EB353DA38DD49CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041679C, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?,?,?,?,?,00416980,?,?,?,004169BE,004169C6), ref: 0041684B
SafeArrayGetUBound.OLEAUT32(?,00000001,?,?,00000001,?,?,?,?,?,00416980,?,?,?,004169BE,004169C6), ref: 00416867
SafeArrayPtrOfIndex.OLEAUT32(?,?,?,?,?,?,?,00416980,?,?,?,004169BE,004169C6), ref: 004168DE
VariantClear.OLEAUT32(?,?,?,?,?,00416980,?,?,?,004169BE,004169C6), ref: 00416907

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 91199727d6961b42540dbac8dddd4b8886eb87291677ac3a79942a3a37c52e04
Instruction ID: 04f03d1d27eba966dfe4a0bf6b33330f6eacf7124f4708d3060d73a5689aa478
Opcode Fuzzy Hash: 91199727d6961b42540dbac8dddd4b8886eb87291677ac3a79942a3a37c52e04
Instruction Fuzzy Hash: F641FC75A016199FCB62EF59C890AD9B3BDAF48304F0141DAE549E7216DA38EFC0CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0041163C, Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,004117E8), ref: 0041166F
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00411693
GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 004116AE
LoadStringW.USER32(00000000,0000FFE8,?,00000100,00400000,?,00000105), ref: 00411749

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 248c224ae4cc015a729eadc0aac475a6d4b18f5767f6cc32f224d0b18d2f2e22
Instruction ID: 6ac76ad86cef69c6558df485b0259bbea5b2dae82ce97de760eff6168fe99703
Opcode Fuzzy Hash: 248c224ae4cc015a729eadc0aac475a6d4b18f5767f6cc32f224d0b18d2f2e22
Instruction Fuzzy Hash: 7C415070A002589FDB20EF69CC81BCAB7F9AB58354F0440FAE508E7391D7799E958F58

Uniqueness

Uniqueness Score: -1.00%

Function 004341F0, Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00432024: EnterCriticalSection.KERNEL32(0050BF20,00000000,0043416D,00000000,?,?,00435AF6,00436584,00000000,?,?), ref: 0043202C
Part of subcall function 00432024: LeaveCriticalSection.KERNEL32(0050BF20,0050BF20,00000000,0043416D,00000000,?,?,00435AF6,00436584,00000000,?,?), ref: 00432039
Part of subcall function 00432024: EnterCriticalSection.KERNEL32(?,0050BF20,0050BF20,00000000,0043416D,00000000,?,?,00435AF6,00436584,00000000,?,?), ref: 00432042

Part of subcall function 00435CDC: GetDC.USER32(00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D32
Part of subcall function 00435CDC: GetDeviceCaps.GDI32(00000000,0000000C,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D47
Part of subcall function 00435CDC: GetDeviceCaps.GDI32(00000000,0000000E,00000000,0000000C,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D51
Part of subcall function 00435CDC: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D75
Part of subcall function 00435CDC: ReleaseDC.USER32(00000000,00000000,00000000,?,?,?,?,00434243,00000000,004342CF), ref: 00435D80

CreateCompatibleDC.GDI32(00000000,00000000,004342CF), ref: 00434245
SelectObject.GDI32(00000000,?,00000000,00000000,004342CF), ref: 0043425E
SelectPalette.GDI32(00000000,?,000000FF,00000000,00000000,004342CF), ref: 00434287
RealizePalette.GDI32(00000000,00000000,?,000000FF,00000000,00000000,004342CF), ref: 00434293

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: 5ad1d68f4328b8f5c33682955f1fab92161ae68c2a9294b837aca3547186ecbf
Instruction ID: 4477db5972192b2150f798a6bea43cc0d3f64bc69b46c982faa01374f772de33
Opcode Fuzzy Hash: 5ad1d68f4328b8f5c33682955f1fab92161ae68c2a9294b837aca3547186ecbf
Instruction Fuzzy Hash: 49312874A00644EFD704EB59C981D9EB7F4FF8C364B2251A6B804AB362C738EE40DB44

Uniqueness

Uniqueness Score: -1.00%

Function 004FCC68, Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(00000000,?,00000000,00000000,00000000), ref: 004FCCCC
OffsetRect.USER32(00000000,00000000,?,00000000,00000000), ref: 004FCCE7
OffsetRect.USER32(00000000,?,00000000,00000000,00000000), ref: 004FCD01
OffsetRect.USER32(00000000,00000000,?,00000000,00000000), ref: 004FCD1C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 2a60d915dcc19cb720c5c42f2c276c7b2e3e88d654c0c6aee3fb6a9f3b5cb8d6
Instruction ID: b015cc47b58ef71ecbdccaad58e3d05b78dcb92e69ba2fec9c3a77b9d850b3d8
Opcode Fuzzy Hash: 2a60d915dcc19cb720c5c42f2c276c7b2e3e88d654c0c6aee3fb6a9f3b5cb8d6
Instruction Fuzzy Hash: 1921A1B67002095BD700DE69CDC1E6B77DAEBC4300F54CA2AF644C3249D634EC058B55

Uniqueness

Uniqueness Score: -1.00%

Function 0045EF58, Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

IsZoomed.USER32(00000000), ref: 0045EF6D
GetParent.USER32(00000000,00000000), ref: 0045EF82
GetWindowRect.USER32(00000000,?,00000000,00000000), ref: 0045EF9B
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000016,00000000,?,00000000,00000000), ref: 0045F006

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$ParentRectZoomed
String ID:
API String ID: 3993858495-0
Opcode ID: c0c0d4245702df8fa06336215fa0ad7e76627583b1064e539114a7a273a43744
Instruction ID: 5722ea95ece46e646a42d2f0848c8d2b5a2d22be60ce638ac979521c1988b151
Opcode Fuzzy Hash: c0c0d4245702df8fa06336215fa0ad7e76627583b1064e539114a7a273a43744
Instruction Fuzzy Hash: CC21DB35A00105EFCB60EF6DC881D9AB7F9AF18305B20455AFA80E7392D636ED44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0047B128, Relevance: 6.1, APIs: 4, Instructions: 75threadwindowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000004), ref: 0047B138
GetWindowThreadProcessId.USER32(?,?,?,00000004), ref: 0047B155
GetCurrentProcessId.KERNEL32(?,00000004), ref: 0047B161
IsWindowVisible.USER32(?,?,00000004), ref: 0047B1B7

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Process$CurrentThreadVisible
String ID:
API String ID: 3926708836-0
Opcode ID: 3ebcf067a2d4122285bcdd0bcff27433ebc9bf030223feabb801686e860a68db
Instruction ID: 43011847648821f608c5513fb77809d883cdcb4e1592327489be5712dd3641a5
Opcode Fuzzy Hash: 3ebcf067a2d4122285bcdd0bcff27433ebc9bf030223feabb801686e860a68db
Instruction Fuzzy Hash: C1215A316012049BD700EB69D995FAA73B5EB1A314F9482B7E918A7363C738AD0587E8

Uniqueness

Uniqueness Score: -1.00%

Function 0047BCA0, Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,0047B729,00000000,0047BC66), ref: 0047BCCD

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ActiveWindow
String ID:
API String ID: 2558294473-0
Opcode ID: ba4935969aa81a0b8bea5860fbdf3b5eeecd83c282bdb865b81139ae98709796
Instruction ID: 3f30a005ac1bce44566be6159db892416ee9e984c831e88609da0a62d9239d54
Opcode Fuzzy Hash: ba4935969aa81a0b8bea5860fbdf3b5eeecd83c282bdb865b81139ae98709796
Instruction Fuzzy Hash: 8521EC70604240DBDB65EE69C8C5BD627A8BF04309F0880BAFD4C9F29BD76DD8458769

Uniqueness

Uniqueness Score: -1.00%

Function 004533C0, Relevance: 6.1, APIs: 4, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetMenuState.USER32(?,?,?,?,?,?,?,?,00452DCB,00000400,?,?,?), ref: 004533E3
GetSubMenu.USER32(?,?,?,?,?,?,?,?,?,?,00452DCB,00000400,?,?,?), ref: 004533EE
GetMenuItemID.USER32(?,?,?,?,?,?,?,?,?,?,00452DCB,00000400,?,?,?), ref: 00453407
GetMenuStringW.USER32(?,?,?,?,?,?,?,?,?,?,00452DCB,00000400,?,?,?), ref: 0045345C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$ItemStateString
String ID:
API String ID: 306270399-0
Opcode ID: cae88e5c466eef685a5eb3a7d23b531e4b7284dd7468bb0c251f5aea974a6ab3
Instruction ID: 149826ce0e327c2f44f5688909a5e375b7f77b610dcc6b72343c755c3d55ddb5
Opcode Fuzzy Hash: cae88e5c466eef685a5eb3a7d23b531e4b7284dd7468bb0c251f5aea974a6ab3
Instruction Fuzzy Hash: 2F116031611114ABCB00EE6DCC419AF77A89F4A3A5B10446BFC09E7383D6389E059768

Uniqueness

Uniqueness Score: -1.00%

Function 00480D2C, Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(00000000,00000000,00000001,00000000,00480DD3,?,?,?,?,00000000), ref: 00480D62
DeleteFileW.KERNEL32(00000000,00000000,00480DD3,?,?,?,?,00000000), ref: 00480D89
GetLastError.KERNEL32(00000000,00000000,00480DD3,?,?,?,?,00000000), ref: 00480D98
MoveFileW.KERNEL32(00000000,00000000,00000000,00000000,00480DD3,?,?,?,?,00000000), ref: 00480DB2

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Move$DeleteErrorLast
String ID:
API String ID: 3032323431-0
Opcode ID: 0512c64b82dd2a23fe44d79748f2dd60c00df7e9e249c2e9efd3198b363333b4
Instruction ID: 9870776ada95ffc5b2d7c810cb8448cbe677a21549435272735ddffc843f8235
Opcode Fuzzy Hash: 0512c64b82dd2a23fe44d79748f2dd60c00df7e9e249c2e9efd3198b363333b4
Instruction Fuzzy Hash: 1201C871710350ABDB61BBBA4C9295E72DCDB4170CB22487BF401F3692DA3D9D15425D

Uniqueness

Uniqueness Score: -1.00%

Function 004FC8FC, Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(F8031024,00000008,?,?,?,00000000), ref: 004FC911
MulDiv.KERNEL32(E8C38B57,00000008,?,F8031024,00000008,?,?,?,00000000), ref: 004FC925
MulDiv.KERNEL32(FFF7631A,00000008,?,E8C38B57,00000008,?,F8031024,00000008,?,?,?,00000000), ref: 004FC939
MulDiv.KERNEL32(E8C38B50,00000008,?,E8C38B57,00000008,?,F8031024,00000008,?,?,?,00000000), ref: 004FC957

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3920b31d1e161edc088133973b0ee393d2f9b67b9e0c4b248c75501a2f7c090a
Instruction ID: 043a3cb066661957d3712cc150bdf3ede8bdd203a749bbf1b48e4faa245d2c1d
Opcode Fuzzy Hash: 3920b31d1e161edc088133973b0ee393d2f9b67b9e0c4b248c75501a2f7c090a
Instruction Fuzzy Hash: 9C113072604258AFCF44DE9DC8C4E9B7BECAF49360F1441A6BA08DB256D675DD00CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00437268, Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 00437289
GetObjectW.GDI32(?,00000018,?,00000000,004372E5,?,?,?), ref: 004372AA
DeleteObject.GDI32(?,004372EC,00000000,004372E5,?,?,?), ref: 004372D6
DeleteObject.GDI32(?,?,004372EC,00000000,004372E5,?,?,?), ref: 004372DF

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: 605b9136f2ec4a3541230686ca11df53302b91ff38893aebe5fa1d8fd2b84003
Instruction ID: 7b469a6ffec88920a4a9acef57a4f468331112aa929b1b52221d60f02b2e1deb
Opcode Fuzzy Hash: 605b9136f2ec4a3541230686ca11df53302b91ff38893aebe5fa1d8fd2b84003
Instruction Fuzzy Hash: C11142B5A04204AFDB14DFE6C9819AEB7FDEB4C310F1080AAF944E7751DA34DD008A58

Uniqueness

Uniqueness Score: -1.00%

Function 0045ABB0, Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?,?,?,?,?,0045AE8D), ref: 0045ABC5
MulDiv.KERNEL32(?,?,?,?,?,?,?,0045AE8D), ref: 0045ABE2
MulDiv.KERNEL32(?,?,?,?,?,?,?,0045AE8D), ref: 0045ABFF
MulDiv.KERNEL32(?,?,?,?,?,?,?,0045AE8D), ref: 0045AC1C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b1a188b9d5470962b1867edf625586a5e045f5e47e417e5d0f1d5c7ef61136
Instruction ID: ae58113f4339da77c68d9c9964eee41e9f0a0c16bb41e1c2d15afc30c3256c11
Opcode Fuzzy Hash: 51b1a188b9d5470962b1867edf625586a5e045f5e47e417e5d0f1d5c7ef61136
Instruction Fuzzy Hash: FF018F113002486BC724BD2B5C84F1BBA5ECFC2755B00423EBD1A8B353EE6CDD14C2A8

Uniqueness

Uniqueness Score: -1.00%

Function 0045AC34, Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?,?,?,?,?,0045AE99), ref: 0045AC49
MulDiv.KERNEL32(?,?,?,?,?,?,?,0045AE99), ref: 0045AC63
MulDiv.KERNEL32(?,?,?,?,?,?,?,0045AE99), ref: 0045AC80
MulDiv.KERNEL32(?,?,?,?,?,?,?,0045AE99), ref: 0045AC9D

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f9501548b92fdf94005ffca052f016db9bf7512737de64f9270803a6f419569
Instruction ID: 9ee3c491476eefb207997d870ec9ab711bbcfc9e5c7f4c7d58030a86d3bb8753
Opcode Fuzzy Hash: 3f9501548b92fdf94005ffca052f016db9bf7512737de64f9270803a6f419569
Instruction Fuzzy Hash: C10156213002086BC724BE265D44F1B7A5ECB82754F00413E7D1A8B35BEABCED1886A8

Uniqueness

Uniqueness Score: -1.00%

Function 00463518, Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?,?,?,?,?,00463630,00000000,00463646), ref: 00463530
MulDiv.KERNEL32(?,?,?,?,?,?,?,00463630,00000000,00463646), ref: 0046354A
MulDiv.KERNEL32(?,?,?,?,?,?,?,00463630,00000000,00463646), ref: 00463567
MulDiv.KERNEL32(?,?,?,?,?,?,?,00463630,00000000,00463646), ref: 00463584

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2683ee414f5d259ef94894423dd0bcd8dfe7df9fa180cccaf8975a7b90f37eac
Instruction ID: fddf769811cf0c8c26c8e32b42c369ecec2c4f243e54a0dc723a9d670a53ab1e
Opcode Fuzzy Hash: 2683ee414f5d259ef94894423dd0bcd8dfe7df9fa180cccaf8975a7b90f37eac
Instruction Fuzzy Hash: 6B015A2130024827C724BE275C44F5B7A5ECF82754F00403E791A8B35BEABCDE0082A8

Uniqueness

Uniqueness Score: -1.00%

Function 0047D2C0, Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?,-00000001,00000000,?,0047D3E1,?,?,?,00000000,?,?,0047984C,00000000,?,00472A42), ref: 0047D2D4
GetWindowLongW.USER32(?,000000EC,?,-00000001,00000000,?,0047D3E1,?,?,?,00000000,?,?,0047984C,00000000), ref: 0047D316
SetWindowLongW.USER32(?,000000EC,00000000,?,000000EC,?,-00000001,00000000,?,0047D3E1,?,?,?,00000000), ref: 0047D327
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,C31852FF,?,-00000001,00000000,?,0047D3E1,?,?,?,00000000), ref: 0047D34F

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$Visible
String ID:
API String ID: 2967648141-0
Opcode ID: 070dfe5ce9853db0640a0b54215abfcda0abe892866fe5d5d7e21adf6ea51ff9
Instruction ID: 000440a25ddaa2286525e82be01aaa39b0c6227038d001e3b9cee71a53820411
Opcode Fuzzy Hash: 070dfe5ce9853db0640a0b54215abfcda0abe892866fe5d5d7e21adf6ea51ff9
Instruction Fuzzy Hash: CD11C871515154AFDB01DB68C848FFD3BF8AB09314F0441A2FA8CCB3A2C239AD40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00426AE4, Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00400000,?,?,004217FC,00400000,00000001,00000000,?,00426A26,00000000,00000000,?,00000000,?,?,004DFDD8), ref: 00426AFB
LoadResource.KERNEL32(00400000,00426B80,00400000,?,?,004217FC,00400000,00000001,00000000,?,00426A26,00000000,00000000,?,00000000,?), ref: 00426B15
SizeofResource.KERNEL32(00400000,00426B80,00400000,00426B80,00400000,?,?,004217FC,00400000,00000001,00000000,?,00426A26,00000000,00000000), ref: 00426B2F
LockResource.KERNEL32(004265C4,00000000,00400000,00426B80,00400000,00426B80,00400000,?,?,004217FC,00400000,00000001,00000000,?,00426A26,00000000), ref: 00426B39

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 58c6b0b1d75b014271bf7c33c9228041a837c00c6d60421df676cd209d355551
Instruction ID: a41061efca6fefb2af05efcc46f9632b31dfcf640ef7029156d5ebc35ff29038
Opcode Fuzzy Hash: 58c6b0b1d75b014271bf7c33c9228041a837c00c6d60421df676cd209d355551
Instruction Fuzzy Hash: 62F04B732042146F9B44EE59A881D5B7BDCEE89364315406AF918D7207DA38ED018768

Uniqueness

Uniqueness Score: -1.00%

Function 004B0D74, Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FDB8: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,0048048E,?,00000000,?,0048042E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0048048E), ref: 0047FDD4

RegDeleteValueW.ADVAPI32(?,00000000,?,00000002,00000000,?,?,?,004B773B), ref: 004B0DB0
RegCloseKey.ADVAPI32(00000000,?,00000000,?,00000002,00000000,?,?,?,004B773B), ref: 004B0DB9
RemoveFontResourceW.GDI32(00000000,?,00000002,00000000,?,?,?,004B773B), ref: 004B0DC6
SendNotifyMessageW.USER32(0000FFFF,0000001D,00000000,00000000,00000000,?,00000002,00000000,?,?,?,004B773B), ref: 004B0DDA

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 8e4e3e1788f028a9df15d139e14dce7a7411b0d1995ffa3bbbf435c59d6cd493
Instruction ID: 48a8dc006831c27cc69ac94adf6fc1cca216b916ebd8d140d20f1953f2c695cf
Opcode Fuzzy Hash: 8e4e3e1788f028a9df15d139e14dce7a7411b0d1995ffa3bbbf435c59d6cd493
Instruction Fuzzy Hash: 60F03AB174031126EA20B6B69C46F9B228C5F48748F14883EB605EB2C3DA7CEC05566D

Uniqueness

Uniqueness Score: -1.00%

Function 00458A3C, Relevance: 6.0, APIs: 4, Instructions: 37threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000,?,?,00000000,00000000,00458AB4,-000000F4,?,?,00458676,?,-0000000C,?), ref: 00458A49
GetCurrentProcessId.KERNEL32(00000000,?,?,00000000,00000000,00458AB4,-000000F4,?,?,00458676,?,-0000000C,?), ref: 00458A52
GlobalFindAtomW.KERNEL32(00000000,00000000,?,?,00000000,00000000,00458AB4,-000000F4,?,?,00458676,?,-0000000C,?), ref: 00458A67
GetPropW.USER32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00458AB4,-000000F4,?,?,00458676,?,-0000000C,?), ref: 00458A7E

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: a3535c4cccd84b3baa909c221828295f0fdc5421150f477206b0cddc220d0ba1
Instruction ID: cf83c5aced97f49b6a16fc684f55e2170c518469329d4d80cc37da479e1c13ad
Opcode Fuzzy Hash: a3535c4cccd84b3baa909c221828295f0fdc5421150f477206b0cddc220d0ba1
Instruction Fuzzy Hash: 93F0A752615123E7D6217BB75C4596F128C8D41355304813FFD00F2193EE2CCC49D2BE

Uniqueness

Uniqueness Score: -1.00%

Function 0050030C, Relevance: 6.0, APIs: 4, Instructions: 35filesynchronizationCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,00000000,00500375,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,005003A4), ref: 00500315
DeleteFileW.KERNEL32(00000000,00000000,00000000,00500375,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,005003A4), ref: 00500323
ReleaseMutex.KERNEL32(00000000,0050037C,00500375,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,005003A4), ref: 00500366
CloseHandle.KERNEL32(00000000,00000000,0050037C,00500375,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,005003A4), ref: 0050036F

Strings

.msg, xrefs: 005000D6
.lst, xrefs: 005000F0
/REG, xrefs: 00500006
Setup, xrefs: 00500042
/REGU, xrefs: 0050002A
S&P, xrefs: 005000C6, 005000D0
Inno-Setup-RegSvr-Mutex, xrefs: 00500061

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteFile$CloseHandleMutexRelease
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$S&P$Setup
API String ID: 3118534315-1680853185
Opcode ID: 2b85445475b894aafd2d20a7de3d940eafbb955b0b9f777be78a23b318fdc3b0
Instruction ID: ed8ded9dfb3c9dc399a19fa66aec2d1dc83a1eea0b70c1bf381f987c00bfee0a
Opcode Fuzzy Hash: 2b85445475b894aafd2d20a7de3d940eafbb955b0b9f777be78a23b318fdc3b0
Instruction Fuzzy Hash: 6FF0E931918640AFDB52EBB5D9139AD7BE8EB45308F520C3BF400E35D2C63C9C01C628

Uniqueness

Uniqueness Score: -1.00%

Function 0047A638, Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,0047DC33), ref: 0047A650
SetWindowsHookExW.USER32(00000003,0047A5F4,00000000,00000000,?,0047DC33), ref: 0047A660
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,0047DC33), ref: 0047A67B
CreateThread.KERNEL32(00000000,000003E8,0047A598,00000000,00000000,?,?,0047DC33), ref: 0047A6A0

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateThread$CurrentEventHookWindows
String ID:
API String ID: 1195359707-0
Opcode ID: 917738181fa714b45d30f605ffe08ada3a357498bb2598911516436119720d30
Instruction ID: 6943bff88148675fdce1f3b8256fd68ee037917d4206f63411866ee616a0de39
Opcode Fuzzy Hash: 917738181fa714b45d30f605ffe08ada3a357498bb2598911516436119720d30
Instruction Fuzzy Hash: 49F01D70684300AEF3109B60EC07F6E3A94E376705F14022AF308AE1D2C3B85C59DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00457908, Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000,?,?,00000000,00000000,0047DFFD,?,00000000,?,00000001,0047C3D0,?,00000000,00000200,0000020A,00000001), ref: 00457915
GetCurrentProcessId.KERNEL32(00000000,?,?,00000000,00000000,0047DFFD,?,00000000,?,00000001,0047C3D0,?,00000000,00000200,0000020A,00000001), ref: 0045791E
GlobalFindAtomW.KERNEL32(00000000,00000000,?,?,00000000,00000000,0047DFFD,?,00000000,?,00000001,0047C3D0,?,00000000,00000200,0000020A), ref: 00457933
GetPropW.USER32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,0047DFFD,?,00000000,?,00000001,0047C3D0,?,00000000), ref: 0045794A

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: caf1da8701c573fec23be1281149ae77c80fce000e045cd29fececb907c50ece
Instruction ID: 21bbb7ddf235e8985e79cc2206f063224f7c30337991ede44fcd4693f3ff56cb
Opcode Fuzzy Hash: caf1da8701c573fec23be1281149ae77c80fce000e045cd29fececb907c50ece
Instruction Fuzzy Hash: B7F0A792609133A6EA1077B6BC9583F2A8C8D023553004537FD45E7243D53C8C0893FC

Uniqueness

Uniqueness Score: -1.00%

Function 004DA168, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008), ref: 004DA171
OpenProcessToken.ADVAPI32(00000000,00000008), ref: 004DA177
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008), ref: 004DA199
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008), ref: 004DA1AA

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 662f493c4e4383a05b0aa2aabd141fd27a531ece1fc93471bed0709a7147aa22
Instruction ID: 24257c99f2129a0494bba822a2cb6ec044b23e63bb4cb713ba521b7bab54778d
Opcode Fuzzy Hash: 662f493c4e4383a05b0aa2aabd141fd27a531ece1fc93471bed0709a7147aa22
Instruction Fuzzy Hash: 5AF030716043007BE700EAB58C82E5B73DCAB84354F04493ABE94D72C2E639DD18D76A

Uniqueness

Uniqueness Score: -1.00%

Function 00437404, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0043740D
SelectObject.GDI32(00000000,058A00B4,00000000), ref: 0043741F
GetTextMetricsW.GDI32(00000000,?,00000000,058A00B4,00000000), ref: 0043742A
ReleaseDC.USER32(00000000,00000000,00000000,058A00B4,00000000), ref: 0043743B

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: 2f2bfe86bb59d55220449037aa3dd034b0f1282392c5e9b096282f7b67183300
Instruction ID: 61be348c495d7b8f6508249db3ee2df45981ccc68eb0771847eb64c630b13b38
Opcode Fuzzy Hash: 2f2bfe86bb59d55220449037aa3dd034b0f1282392c5e9b096282f7b67183300
Instruction Fuzzy Hash: 4AE0D8517461B122E72061760C82BDF294C4F26269F081126FC84A92E3DB0CCD1192FA

Uniqueness

Uniqueness Score: -1.00%

Function 00470EAC, Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0047D977), ref: 00470EB2
EnumWindows.USER32(00470E74), ref: 00470ECB
GetCurrentThreadId.KERNEL32(00470E54), ref: 00470EDA
EnumThreadWindows.USER32(00000000,00470E54), ref: 00470EE0

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: EnumThreadWindows$ActiveCurrentWindow
String ID:
API String ID: 1202916826-0
Opcode ID: 70d7849c68577c3998d5f5c07a8aab975d912b2e6c16a2a1562fcf2adc69ae44
Instruction ID: a9b7054afdf2a76db49fbaeff05d6c9c3f608711d48c68b2744adb783a0e1eb0
Opcode Fuzzy Hash: 70d7849c68577c3998d5f5c07a8aab975d912b2e6c16a2a1562fcf2adc69ae44
Instruction Fuzzy Hash: 15E0E69168D340AAF60062764D467AA75C8CA91764F248D2FBCD8A72C3D67E8C04637F

Uniqueness

Uniqueness Score: -1.00%

Function 004A071C, Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 308COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?,004A0847), ref: 004A083A

Part of subcall function 00408D5C: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00408DA1

Strings

Variant is null, cannot invoke, xrefs: 004A0774
\*H, xrefs: 004A087E

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: String$FreeLoad
String ID: Variant is null, cannot invoke$\*H
API String ID: 62760895-316738874
Opcode ID: dc841cf8ce847253cdad8326e9c7a7cea58deaa37a3ed0bbb77ec1af655fee74
Instruction ID: b8350d8c0238e6d070eae2881dc6a6db183a908389c3ed7cb60a16b19af4717f
Opcode Fuzzy Hash: dc841cf8ce847253cdad8326e9c7a7cea58deaa37a3ed0bbb77ec1af655fee74
Instruction Fuzzy Hash: D7C16F70A002099FDB10DF99C981A9EB7F6FF59314F24813AE804EB355D778AD46CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004841BC, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?,004844CB,?,?,?,?,00000000,00000000,004844C4,?,00000000,004844E7), ref: 004844BA

Strings

8H, xrefs: 00484210
H, xrefs: 00484271

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeString
String ID: H$8H
API String ID: 3341692771-993965464
Opcode ID: fc46f2b2d6f036c341f4bc4f9d10a6e2ae094fd92bda4e970f4eb40756c6c380
Instruction ID: 97c30db2fb9d58bd4856a7502c69323d356b3cb13838d027515aa3958163c2fa
Opcode Fuzzy Hash: fc46f2b2d6f036c341f4bc4f9d10a6e2ae094fd92bda4e970f4eb40756c6c380
Instruction Fuzzy Hash: 43B10374A01609EFDB10DF99D480A9EBBF2FF89314F24856AE805AB361D738AC45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00441BE4, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 00441E36
OffsetRect.USER32(?,000000FF,000000FF), ref: 00441E77

Strings

..., xrefs: 00441D31, 00441DF5

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: OffsetRect
String ID: ...
API String ID: 177026234-440645147
Opcode ID: e4f94bebf021e312d53e3913e4fa6ca02c890e485b2c7204cedd324d69716898
Instruction ID: 61d6f20a90ccb1b860ab3e10858628717df5f677759fd7f06f546c8b783e31bf
Opcode Fuzzy Hash: e4f94bebf021e312d53e3913e4fa6ca02c890e485b2c7204cedd324d69716898
Instruction Fuzzy Hash: B1916B34B001049BEB11DF69C985BDA77F5AF49304F6440B6E804EB3A6D778EE85CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0045904C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

$GE, xrefs: 004590B7

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: $GE
API String ID: 0-2039176179
Opcode ID: 17e63f08d1de8be797b84e263b61b08b5dc4b4f824545f67540742fd97711cd0
Instruction ID: 92e80e7c8a30cfee40164413cc279b2d5c46f6e3efed990b8f7548cde1df018e
Opcode Fuzzy Hash: 17e63f08d1de8be797b84e263b61b08b5dc4b4f824545f67540742fd97711cd0
Instruction Fuzzy Hash: 6D51C470A00609DFDB00DF59D845A9EBBF5FF99315F1081AAEC00A7352D738AD89CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004110E4, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 106threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,004111F7,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00411100

Strings

<:P, xrefs: 0041118D
X:P, xrefs: 004111B2

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: LocaleThread
String ID: <:P$X:P
API String ID: 635194068-1818244020
Opcode ID: af7afc06263425bf98758ada9f48ed7f25255b360baf71a442fbc2f36bcd259f
Instruction ID: c11acfbaae4cdb5f5916583f11e3aac9aa27a491b610af47e1548b2c8692ca02
Opcode Fuzzy Hash: af7afc06263425bf98758ada9f48ed7f25255b360baf71a442fbc2f36bcd259f
Instruction Fuzzy Hash: 1E31C871F005086BDB00DB45D882AAE7BEDE788314F61443BFA09D73C1DA39ED458769

Uniqueness

Uniqueness Score: -1.00%

Function 004DB020, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FDB8: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,0048048E,?,00000000,?,0048042E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0048048E), ref: 0047FDD4

RegCloseKey.ADVAPI32(?,004DB10C,004D8B5A,?,00000001,00000000,00000000,004DB12A,?,?), ref: 004DB0F3

Strings

%s\%s_is1, xrefs: 004DB09B
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 004DB07D

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: 1b58e4f8b933d7ac63f29fc724be7419a24410dd793340050769d1ce1b6cdb1f
Instruction ID: 509b5f1ef87e2919467e351fb24d703935cb4b13155d30c904a0b9c829f5fe2c
Opcode Fuzzy Hash: 1b58e4f8b933d7ac63f29fc724be7419a24410dd793340050769d1ce1b6cdb1f
Instruction Fuzzy Hash: D4315430B042589FDB01DBA9CC626AEB7F8EB49704F51447BF504E7381D7789E148B99

Uniqueness

Uniqueness Score: -1.00%

Function 004E28A4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004E2A84,?,?,00000001,00000000), ref: 004E28DF

Strings

/SPAWNWND=$%x /NOTIFYWND=$%x , xrefs: 004E294A
S&P, xrefs: 004E2942

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window
String ID: /SPAWNWND=$%x /NOTIFYWND=$%x $S&P
API String ID: 2353593579-829071356
Opcode ID: 73daf90602b22ba1de4b9cfcb20406c0de13764bcb984d207294fb3082178e4c
Instruction ID: da8f141b86379732ef4eccaf47bcca1481121017c122ef3f64d892ef391278b1
Opcode Fuzzy Hash: 73daf90602b22ba1de4b9cfcb20406c0de13764bcb984d207294fb3082178e4c
Instruction Fuzzy Hash: 6F31D570A003889FCB01CF66C891F9EBFF8EB09304F0144A6E944A7351D778AD04CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004B0074, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C,00000000,004B0158,?,?,?,00000001), ref: 004B0110
GetLastError.KERNEL32(0000003C,00000000,004B0158,?,?,?,00000001), ref: 004B011F

Part of subcall function 0047F7D8: GetSystemDirectoryW.KERNEL32(?,00000104,?,004FF876,00000000,004FFA91,?,?,00000005,00000000,004FFACA,?,?,00000000,?), ref: 0047F7EB

Strings

<, xrefs: 004B00CA

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: 4acc068491754a00c66cd06e5b26088c4f3f76b109c23df6d9705efe590850a0
Instruction ID: aa5a08e859319d07987ae7cc84c0a77a45772f2e5f5ef86c34a6ab0b02d9e170
Opcode Fuzzy Hash: 4acc068491754a00c66cd06e5b26088c4f3f76b109c23df6d9705efe590850a0
Instruction Fuzzy Hash: 72217C709042089FCB10EF69C882ADF7BE8AF08345F50003BF845E3281E7789D55CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004AA648, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,0000044B,00000000,?,00000000,004AA727), ref: 004AA6DB
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001,00000000,0000044B,00000000,?,00000000,004AA727), ref: 004AA70C

Strings

open, xrefs: 004AA6FF

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: 16e8d08dd5c8a501b1903583b0813ed33448ee86d1fcca49ebb81a8ef93e0c35
Instruction ID: 8fa6787134c4825b9097c6b134674cdbcb2c4a430d682ef604d98822b7c8bf5b
Opcode Fuzzy Hash: 16e8d08dd5c8a501b1903583b0813ed33448ee86d1fcca49ebb81a8ef93e0c35
Instruction Fuzzy Hash: 2F217F74E40208AFCB04DFA9CC86A9EB7F8EB55304F21847AE401EB291D738DE50CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00449200, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000001A7,?,00000000,00000000,004492D5), ref: 0044923F

Strings

,B, xrefs: 00449269
4B, xrefs: 0044929C

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID: ,B$4B
API String ID: 3850602802-1768493830
Opcode ID: 00f691e836e04e9428cad136e8185c179c438a6f23c6e66ab870850674fc7835
Instruction ID: 359ddaf12e1a893020def0401ad42d0c93543f7b96e40f2d671ac813b823042f
Opcode Fuzzy Hash: 00f691e836e04e9428cad136e8185c179c438a6f23c6e66ab870850674fc7835
Instruction Fuzzy Hash: CA219074A04204AFDB00DFA5CC91AAE77A4EB49314F104ABAF914A73D1D7786D00DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004FE17E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 004FE1BE

Strings

@, xrefs: 004FE184
/INITPROCWND=$%x , xrefs: 004FE1EE

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: cbb2cdd330d0b16d2c7c00f33112fa707cec1511ef86b5025d34653bd4f0509c
Instruction ID: 0601d4f322c82ed6599d8453465a674ade57d76be6656c412abcfcbfef96312a
Opcode Fuzzy Hash: cbb2cdd330d0b16d2c7c00f33112fa707cec1511ef86b5025d34653bd4f0509c
Instruction Fuzzy Hash: DB21A8316083488FD701DBA6D851BBFB7F8EB49304F5148BBE504E72A1E67C9905C759

Uniqueness

Uniqueness Score: -1.00%

Function 004FD880, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,004FD954,?,004FD944,00000000,004FD928), ref: 004FD8ED
CloseHandle.KERNEL32(004FD998,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,004FD954,?,004FD944,00000000), ref: 004FD90A

Part of subcall function 004FD7D8: GetLastError.KERNEL32(00000000,004FD873,?,?,?), ref: 004FD7FB

Strings

D, xrefs: 004FD8C7

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: b575a76babaeb0eaf3ab611905f32145e394ea09ef4907aee8beab6d1673b72e
Instruction ID: 234929de422dcefd16943bd9524d3b374fe22786ed20a3cc3a7fb2948557de56
Opcode Fuzzy Hash: b575a76babaeb0eaf3ab611905f32145e394ea09ef4907aee8beab6d1673b72e
Instruction Fuzzy Hash: 87115EB0A0420CAFD700DBE5CC42FAEB7ECDF49708F51407AF605E7681E6789E058668

Uniqueness

Uniqueness Score: -1.00%

Function 0045B514, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0045B57D
IntersectClipRect.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,00000000), ref: 0045B58F

Part of subcall function 00408D5C: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00408DA1

Strings

lB, xrefs: 0045B54A

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ClipIntersectLoadRectStringViewport
String ID: lB
API String ID: 2734429277-323450203
Opcode ID: 5bf0a81592425f869a54e1d5c61b7d91542dbe8c9474ea0c8c9c54a25c4de639
Instruction ID: d3cd5b29bfdae97dff9bb48d5cf675a6e0067ef4f76b7c3d30f904d5bb72c08c
Opcode Fuzzy Hash: 5bf0a81592425f869a54e1d5c61b7d91542dbe8c9474ea0c8c9c54a25c4de639
Instruction Fuzzy Hash: 15114C71614208AFDB04DF58CC91FAE77A8EB09314F5040AAFE04EB292E775AD44CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00412F48, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 00412F6A
GetSystemMetrics.USER32(0000004A), ref: 00412FBB

Strings

\9P, xrefs: 00412F95

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: LocaleMetricsSystemThread
String ID: \9P
API String ID: 3035471613-4278768264
Opcode ID: 757a0e559e40e5a41d3c890f96c52c75c320be25d21c42d0319877c3517c572c
Instruction ID: 31e5eae10f502d01882e41f6d69892d0b08bb072847d3d54028db8fba9730883
Opcode Fuzzy Hash: 757a0e559e40e5a41d3c890f96c52c75c320be25d21c42d0319877c3517c572c
Instruction Fuzzy Hash: 440126301042108ACB109E2699813A37BE89B11314F08C0ABEC48CF3D7DABDC996D7B9

Uniqueness

Uniqueness Score: -1.00%

Function 004FEFC8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 004B0418: GetCurrentProcess.KERNEL32(00000028), ref: 004B0428
Part of subcall function 004B0418: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004B042E

SetForegroundWindow.USER32(?), ref: 004FF001

Strings

Not restarting Windows because Uninstall is being run from the debugger., xrefs: 004FF038
Restarting Windows., xrefs: 004FEFD8

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentForegroundOpenTokenWindow
String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
API String ID: 3179053593-4147564754
Opcode ID: 6ba0bff34e2e772fd5fe9906a6c0f7b3613e0bb5d98bbf284fe365508a62b04a
Instruction ID: 4a9705b0615dc25f9449045e92eda835b97671fb351977a8024f03d633086d5b
Opcode Fuzzy Hash: 6ba0bff34e2e772fd5fe9906a6c0f7b3613e0bb5d98bbf284fe365508a62b04a
Instruction Fuzzy Hash: 6D1186306042488FD700EB65D841BAE73E4AF49304F5140BBF544A72A3DBBDAC09DB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00438190, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,?,?,?,?,?,?,?,0043812D), ref: 004381C3
SwitchToThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0043812D), ref: 004381D0

Strings

XpP, xrefs: 00438197

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: CompareExchangeInterlockedSwitchThread
String ID: XpP
API String ID: 3384000618-3652881944
Opcode ID: 1b84b9260930cbca383b457ebf695f418eef9f41db40af694dd630e83705adeb
Instruction ID: 5db5538eeec3d77ec169ee2234a573b5eb7071b9865b862fd10193e83e66f83c
Opcode Fuzzy Hash: 1b84b9260930cbca383b457ebf695f418eef9f41db40af694dd630e83705adeb
Instruction Fuzzy Hash: A3F0F67260D7905AEB22121A5C40B3BAAC9ABC6370F29123FF494872D1CE7D5C43D3A6

Uniqueness

Uniqueness Score: -1.00%

Function 0042DD10, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0042DD5E
GetSystemMetrics.USER32(00000001), ref: 0042DD70

Part of subcall function 0042DA04: GetProcAddress.KERNEL32(77400000,00000000,00000000,0042DAE6), ref: 0042DAA0

Strings

MonitorFromPoint, xrefs: 0042DD22

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem$AddressProc
String ID: MonitorFromPoint
API String ID: 1792783759-1072306578
Opcode ID: e337e30eebb7d1a1657c793d1521a95decd81eec7c0f3dfc520b914b01f4ed4d
Instruction ID: 390c5dc123b9d5a2da64a109b06d51f506841537fbfc3ef0486dcb37862d3a47
Opcode Fuzzy Hash: e337e30eebb7d1a1657c793d1521a95decd81eec7c0f3dfc520b914b01f4ed4d
Instruction Fuzzy Hash: 9D01A231B145686FEB004F51EC84BAFBB69EB50354FD0812AFA05DB351C3B59C0A9BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042DBC0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0042DC11
GetSystemMetrics.USER32(00000001), ref: 0042DC1D

Part of subcall function 0042DA04: GetProcAddress.KERNEL32(77400000,00000000,00000000,0042DAE6), ref: 0042DAA0

Strings

MonitorFromRect, xrefs: 0042DBD5

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem$AddressProc
String ID: MonitorFromRect
API String ID: 1792783759-4033241945
Opcode ID: e98270b370a09d3712c88059806d615bd46c8b3780238942dcf4d25e6d90ce89
Instruction ID: 744150379f2ca0e070fd094ec72f766510ec69e737baa3fa4e3e815eb33860cc
Opcode Fuzzy Hash: e98270b370a09d3712c88059806d615bd46c8b3780238942dcf4d25e6d90ce89
Instruction Fuzzy Hash: D4018471B001645BE7108F05E8C9B9BB76CE760751F944453EA04CA342C7F8DC48DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004FFB28, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 004E0438: FreeLibrary.KERNEL32(?,004FFB54,00000000,004FFB63,?,?,?,?,?,0050063F), ref: 004E044E

Part of subcall function 004E0054: GetTickCount.KERNEL32(004E0000,00000000,00000000,00000001,00000001,00000000,004E00E6,?,00000000,?,004FFB59,00000000,004FFB63), ref: 004E009C

Part of subcall function 004B23C0: SendMessageW.USER32(00000000,00000B01,00000000,00000000,004FFAA5), ref: 004B23DF

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,0050063F), ref: 004FFB7D
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,0050063F), ref: 004FFB83

Strings

Detected restart. Removing temporary directory., xrefs: 004FFB37

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 9047403d0a6987f239a629bbfd8b614e89f45c0667ae98211cd3609e6ebaedf3
Instruction ID: 29423738bc329908789145c3df0dcd10caa1e10de94f021d7d54b44703bf3484
Opcode Fuzzy Hash: 9047403d0a6987f239a629bbfd8b614e89f45c0667ae98211cd3609e6ebaedf3
Instruction Fuzzy Hash: A0E0E5725046486FD21237B7FC2297F7B9CDF46368750047BF20481592D96D6848D27C

Uniqueness

Uniqueness Score: -1.00%

Function 004529BC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 004529D7
GetKeyState.USER32(00000011,00000010), ref: 004529E8

Strings

, xrefs: 004529F7

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: State
String ID:
API String ID: 1649606143-3916222277
Opcode ID: cab1bdafb9122733afa4fbd1756226bfb5af342b11a1a0875a43e8731c41a78b
Instruction ID: 6b0a78e7c9ebe5d2b1748f83ff2cb54d4bb1d0f4813d0ba40b73a297888c1e33
Opcode Fuzzy Hash: cab1bdafb9122733afa4fbd1756226bfb5af342b11a1a0875a43e8731c41a78b
Instruction Fuzzy Hash: EFE0226270068202FB22B5792D013EB57904F533AAF0802ABFDC02A2C3E5DE0E0A50A6

Uniqueness

Uniqueness Score: -1.00%

Function 00439644, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(DWMAPI.DLL,?,?,0043970A,?,0046172B), ref: 0043966A

Strings

DWMAPI.DLL, xrefs: 00439665
DwmIsCompositionEnabled, xrefs: 00439682

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad
String ID: DWMAPI.DLL$DwmIsCompositionEnabled
API String ID: 1029625771-2128843254
Opcode ID: 682e18011c7677f77fff2e3f3743aa4c3a1ab5f3e5876246b23c4a17889b379d
Instruction ID: dd296409a269e5fd2a7b5dc9cf6eaf0b6947aeafa59fb9ceac4e2c8604a4c007
Opcode Fuzzy Hash: 682e18011c7677f77fff2e3f3743aa4c3a1ab5f3e5876246b23c4a17889b379d
Instruction Fuzzy Hash: 52F054F0503210DFE7205B6CAC5D74F3A94972E315F105667E90192261C3BD4C48DF69

Uniqueness

Uniqueness Score: -1.00%

Function 00480B18, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 00480BA8: GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,00480B26,?,00000001,00000000,004E3FA2,-00000010,?,00000004,0000001C,00000000,004E42C2), ref: 00480BB6

GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonCreate,?,00000001,00000000,004E3FA2,-00000010,?,00000004,0000001C,00000000,004E42C2,?,004B9F8C,00000000,004E432A), ref: 00480B30

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

Strings

ShutdownBlockReasonCreate, xrefs: 00480B26
user32.dll, xrefs: 00480B2B

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule$AddressProc
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 1883125708-2866557904
Opcode ID: 3524f67c40baa0c91fb0f5a492c3f2fe092d7df745565bb4ea645dcbcb60da76
Instruction ID: d5f53f6b86df71dc7240e3beb602866b94299aeddb56d952a361384c5b9ca89c
Opcode Fuzzy Hash: 3524f67c40baa0c91fb0f5a492c3f2fe092d7df745565bb4ea645dcbcb60da76
Instruction Fuzzy Hash: 8EE0C2327205203E828132FA1CC1D6F008C8E8066E3200C77F105E3143D96DEC0A437D

Uniqueness

Uniqueness Score: -1.00%

Function 0047F804, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetSystemWow64DirectoryW,?,004AE723,00000000,004AE7F1,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,004AEC16), ref: 0047F820

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

Strings

kernel32.dll, xrefs: 0047F81B
GetSystemWow64DirectoryW, xrefs: 0047F816

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 1646373207-1816364905
Opcode ID: fe7173b6b88b60ab7bd200f499125b48f4d10f9d6f514ecc0b92b8a7e1180903
Instruction ID: 56a8153d601d8a445181b9efeb01dd75706ff90c1f0cf4327cf126887ff8ee1f
Opcode Fuzzy Hash: fe7173b6b88b60ab7bd200f499125b48f4d10f9d6f514ecc0b92b8a7e1180903
Instruction Fuzzy Hash: BAE0D86470474013D710B77A4CD3A9B11460780704F26C83F3A18F22C2EE7DE84C816F

Uniqueness

Uniqueness Score: -1.00%

Function 00480BA8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,00480B26,?,00000001,00000000,004E3FA2,-00000010,?,00000004,0000001C,00000000,004E42C2), ref: 00480BB6

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

Strings

ShutdownBlockReasonDestroy, xrefs: 00480BAC
user32.dll, xrefs: 00480BB1

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: c4204b687ee01f1ef8655dcfbfe2f3b1179d866ef44a058fd73cea948f9ec398
Instruction ID: 567e2ba806e37c3059746786aa09f517e37634e2a63b51b70c1784171d9f0f7d
Opcode Fuzzy Hash: c4204b687ee01f1ef8655dcfbfe2f3b1179d866ef44a058fd73cea948f9ec398
Instruction Fuzzy Hash: 3DD0C762761716266A9035F51CD1E9F418C8E5169A3240C77F910F1142D59DEC4553EC

Uniqueness

Uniqueness Score: -1.00%

Function 00437DC4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ole32.dll,?,00437E5E), ref: 00437DCA

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

Strings

ole32.dll, xrefs: 00437DC5
CoWaitForMultipleHandles, xrefs: 00437DD5

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: CoWaitForMultipleHandles$ole32.dll
API String ID: 1646373207-2593175619
Opcode ID: 867342c2105f4cd49a1649e1ce1d916fb7dab9630ea99b5142e5648068568c55
Instruction ID: 0276bac4116dd59c961404918caf5124070abbfa233c7396083ad46d4303e638
Opcode Fuzzy Hash: 867342c2105f4cd49a1649e1ce1d916fb7dab9630ea99b5142e5648068568c55
Instruction Fuzzy Hash: 45D0A7F010434A5BE3201FB15CC672F22946B18345F10382BA14416546CBBD4C589A0C

Uniqueness

Uniqueness Score: -1.00%

Function 00500674, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000,00502653,?,?,000000EC,00000000,?,000000EC), ref: 0050067E

Part of subcall function 00409620: GetProcAddress.KERNEL32(?,?,00000000,00409683,?,?,?,00000000,?,00500689,00000000,user32.dll,DisableProcessWindowsGhosting,0050262D,00000001,00000000), ref: 00409644

Strings

user32.dll, xrefs: 00500679
DisableProcessWindowsGhosting, xrefs: 00500674

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: b559cbeeac9ef6ebd4fb99c7a0641d7e8412f93801f6f88047f27b49f6e1c61b
Instruction ID: a12326ddaf09139e4a94bf7ef6cb6bc5bd64e2131c6f28a5ca59e23a7f0ab61e
Opcode Fuzzy Hash: b559cbeeac9ef6ebd4fb99c7a0641d7e8412f93801f6f88047f27b49f6e1c61b
Instruction Fuzzy Hash: BAB092B064170220D9003BF20C02B2E080A2BC0714F0028257414A00C2DD6B9820843D

Uniqueness

Uniqueness Score: -1.00%

Function 004B04BC, Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 004B04DB
Sleep.KERNEL32(?), ref: 004B04EB
GetLastError.KERNEL32 ref: 004B04FE
GetLastError.KERNEL32 ref: 004B0508

Memory Dump Source

Source File: 00000005.00000002.484967889.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.484933344.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485325783.0000000000503000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485335508.0000000000506000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485342323.0000000000507000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485355850.000000000050B000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485363496.000000000050E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.485373235.0000000000510000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.485386526.0000000000514000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.485498588.0000000000552000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 93b20aa5ef53ea9395feab9ecbc6c292e935571960644babedb265d3dedb20a1
Instruction ID: 968b3922318a2079fb9223a28229939b3b519494f59f948e7db40f9d52f71e14
Opcode Fuzzy Hash: 93b20aa5ef53ea9395feab9ecbc6c292e935571960644babedb265d3dedb20a1
Instruction Fuzzy Hash: 92F0B4B2A012187B8B31E5AE9D419EFB398EA9536AB11412BFA04D3702D439DD4186B9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
Tactics:	Initial Access
Data Sources:	DNS records, Detonation chamber, Email gateway, Mail server, Packet capture, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report yVn2ywuhEC.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Initial Sample

Memory Dumps

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Bitcoin Miner:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre